Skip to content
Fencer Intel
high 8.5

CVE-2020-15196 json

Heap buffer overflow in Tensorflow

published 6y ago modified 2mo ago also BIT-tensorflow-2020-15196 , EUVD-2020-0192 , GHSA-pg59-2f92-5cph , PYSEC-2020-119 , PYSEC-2020-276 , PYSEC-2020-311

cvss
8.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits
0
none known

Summary

In Tensorflow version 2.3.0, the `SparseCountSparseOutput` and `RaggedCountSparseOutput` implementations don't validate that the `weights` tensor has the same shape as the data. The check exists for `DenseCountSparseOutput`, where both tensors are fully specified. In the sparse and ragged count weights are still accessed in parallel with the data. But, since there is no validation, a user passing fewer weights than the values for the tensors can generate a read from outside the bounds of the heap buffer allocated for the weights. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.

Patch / fix

  • pypi tensorflow 2.3.1
  • pypi tensorflow-cpu 2.3.1
  • pypi tensorflow-gpu 2.3.1
  • bitnami tensorflow 2.3.1

Is CVE-2020-15196 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.91% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pg59-2f92-5cph referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
GitHub 3.1 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
OSV 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi tensorflow
>=2.3.0, <2.3.1
<2.3.1
2.3.1
pypi tensorflow-cpu
>=2.3.0, <2.3.1
<2.3.1
2.3.1
pypi tensorflow-gpu
>=2.3.0, <2.3.1
<2.3.1
2.3.1
bitnami tensorflow
>=2.3.0, <2.3.1
2.3.1

Affected products

  • tensorflow tensorflow

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-122 Heap-based Buffer Overflow
  • CWE-125 Out-of-bounds Read

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.