Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Tensorflow: Uninitialized Tensor Can Cause Program Crash

CVE-2020-15190 · published 6 years ago
Summary

Certain versions of Tensorflow can cause a program to crash if it encounters an uninitialized tensor. This occurs when a specific operation is used in a certain way. Affected users should update to the latest patched version of Tensorflow to prevent crashes.

What to do
  • Update google inc. tensorflow to version 1.15.4.
  • Update google inc. tensorflow to version 2.0.3.
  • Update google inc. tensorflow to version 2.1.2.
  • Update google inc. tensorflow to version 2.2.1.
  • Update google inc. tensorflow to version 2.3.1.
  • Update google tensorflow-gpu to version 1.15.4.
  • Update google tensorflow-gpu to version 2.0.3.
  • Update google tensorflow-gpu to version 2.1.2.
  • Update google tensorflow-gpu to version 2.2.1.
  • Update google tensorflow-gpu to version 2.3.1.
  • Update google inc. tensorflow-cpu to version 1.15.4.
  • Update google inc. tensorflow-cpu to version 2.0.3.
  • Update google inc. tensorflow-cpu to version 2.1.2.
  • Update google inc. tensorflow-cpu to version 2.2.1.
  • Update google inc. tensorflow-cpu to version 2.3.1.
Affected software
Ecosystem VendorProductAffected versions
pip google inc. tensorflow < 1.15.4
>= 2.0.0, < 2.0.3
>= 2.1.0, < 2.1.2
2.2.0
2.3.0
Fix: upgrade to 1.15.4
pip google tensorflow-gpu < 1.15.4
>= 2.0.0, < 2.0.3
>= 2.1.0, < 2.1.2
2.2.0
2.3.0
Fix: upgrade to 1.15.4
pip google inc. tensorflow-cpu < 1.15.4
>= 2.0.0, < 2.0.3
>= 2.1.0, < 2.1.2
2.2.0
2.3.0
Fix: upgrade to 1.15.4
– google tensorflow < 1.15.4
>= 2.0.0, < 2.0.3
>= 2.1.0, < 2.1.2
>= 2.2.0, < 2.2.1
>= 2.3.0, < 2.3.1
cpe:2.3:a:google:tensorflow:*:*:*:*:-:*:*:*
– opensuse leap 15.2
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
Original advisory text
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value,...
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. However, the eager runtime traverses all tensors in the output. Since only one of the tensors is defined, the other one is `nullptr`, hence we are binding a reference to `nullptr`. This is undefined behavior and reported as an error if compiling with `-fsanitize=null`. In this case, this results in a segmentation fault The issue is patched in commit da8558533d925694483d2c136a9220d6d49d843c, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
CWE-476NULL Pointer Dereference
Timeline
Published25 Sep 2020
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-4g9f-63rx-5cw4 · GHSA
CVE-2020-15190 · NVD
Track software like this
Free during beta