CVE-2020-15203: Denial of Service in Tensorflow
Impact By controlling the fill argument of tf.strings.asstring, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/asstringop.cc#L68-L74
This can result in unexpected output: python In [1]: tf.strings.asstring(input=[1234], width=6, fill='-') Out[1]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['1234 '], dtype=object)> In [2]: tf.strings.asstring(input=[1234], width=6, fill='+') Out[2]: <tf.Tensor: shape=(1,), dtype=string, numpy=array([' +1234'], dtype=object)> In [3]: tf.strings.asstring(input=[1234], width=6, fill="h") Out[3]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['%6d'], dtype=object)> In [4]: tf.strings.asstring(input=[1234], width=6, fill="d") Out[4]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['12346d'], dtype=object)> In [5]: tf.strings.asstring(input=[1234], width=6, fill="o") Out[5]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['23226d'], dtype=object)> In [6]: tf.strings.asstring(input=[1234], width=6, fill="x") Out[6]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['4d26d'], dtype=object)> In [7]: tf.strings.asstring(input=[1234], width=6, fill="g") Out[7]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['8.67458e-3116d'], dtype=object)> In [8]: tf.strings.asstring(input=[1234], width=6, fill="a") Out[8]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['0x0.00ff7eebb4d4p-10226d'], dtype=object)> In [9]: tf.strings.asstring(input=[1234], width=6, fill="c") Out[9]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['\xd26d'], dtype=object)> In [10]: tf.strings.asstring(input=[1234], width=6, fill="p") Out[10]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['0x4d26d'], dtype=object)> In [11]: tf.strings.asstring(input=[1234], width=6, fill='m') Out[11]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['Success6d'], dtype=object)>
However, passing in n or s results in segmentation fault.
Patches We have patched the issue in 33be22c65d86256e6826666662e40dbdfe70ee83 and will release patch releases for all versions between 1.15 and 2.3.
We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Other sources
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the fill argument of tf.strings.asstring, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15203?
The severity of CVE-2020-15203 is classified as high due to its potential to allow arbitrary code execution through a format string vulnerability.
How do I fix CVE-2020-15203?
To fix CVE-2020-15203, upgrade to TensorFlow version 2.3.1 or later, or other specified safe versions depending on your current version.
Which versions of TensorFlow are affected by CVE-2020-15203?
CVE-2020-15203 affects TensorFlow versions 2.3.0, 2.2.0, 2.1.0, 2.0.0, and 1.15.4.
What is a format string vulnerability as it pertains to CVE-2020-15203?
A format string vulnerability in CVE-2020-15203 allows attackers to manipulate the input to functions like printf, potentially leading to code execution.
Is CVE-2020-15203 specific to TensorFlow CPU or GPU versions?
CVE-2020-15203 affects both TensorFlow CPU and GPU versions, meaning users of either can be vulnerable.