CVE-2020-15192: Memory leak in Tensorflow
Impact If a user passes a list of strings to dlpack.todlpack there is a memory leak following an expected validation failure: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L100-L104
The allocated memory is from https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L256
The issue occurs because the status argument during validation failures is not properly checked: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L265-L267
Since each of the above methods can return an error status, the status value must be checked before continuing.
Patches We have patched the issue in 22e07fb204386768e5bcbea563641ea11f96ceb8 and will release a patch release for all affected versions.
We recommend users to upgrade to TensorFlow 2.2.1 or 2.3.1.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been discovered during variant analysis of GHSA-rjjg-hgv6-h69v.
Other sources
In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to dlpack.todlpack there is a memory leak following an expected validation failure. The issue occurs because the status argument during validation failures is not properly checked. Since each of the above methods can return an error status, the status value must be checked before continuing. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15192?
CVE-2020-15192 is classified as having a medium severity due to the potential for memory leaks.
How do I fix CVE-2020-15192?
To mitigate CVE-2020-15192, upgrade TensorFlow to version 2.3.1 or later.
What versions of TensorFlow are affected by CVE-2020-15192?
CVE-2020-15192 affects TensorFlow versions 2.3.0 and 2.2.0.
Can CVE-2020-15192 be exploited remotely?
CVE-2020-15192 is not a remotely exploitable vulnerability as it requires the user to pass malicious input.
What software packages are impacted by CVE-2020-15192?
CVE-2020-15192 impacts the tensorflow, tensorflow-gpu, and tensorflow-cpu packages.