CVE-2020-15198

Summary

In Tensorflow before version 2.3.1, the SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has the same shape as the values one. The values in these tensors are always accessed in parallel. Thus, a shape mismatch can result in accesses outside the bounds of heap allocated buffers. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.

Affected Software

VendorProductVersion RangeStatus
tensorflowtensorflow>= 2.3.0, < 2.3.1affected

Weaknesses

  • CWE-122: {"CWE-122":"Heap-based Buffer Overflow"}
  • CWE-119: {"CWE-119":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}

ADP Enrichment

CVE Program Container

Additional References

References