Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

TensorFlow Lite: Models Can Write Outside of Memory Limits

CVE-2020-15212 · published 6 years ago
Summary

A bug in TensorFlow Lite versions 2.2.0 and earlier can cause models to write data outside of allocated memory, potentially leading to crashes or further security issues. To fix this, update to versions 2.2.1 or 2.3.1. As a temporary measure, you can add custom checks to ensure segment IDs are always positive, but this only works for static segment IDs. If segment IDs are generated during inference, upgrading to the patched version is the best course of action.

What to do
  • Update google tensorflow-gpu to version 2.2.1.
  • Update google tensorflow-gpu to version 2.3.1.
  • Update google inc. tensorflow-cpu to version 2.2.1.
  • Update google inc. tensorflow-cpu to version 2.3.1.
  • Update google inc. tensorflow to version 2.2.1.
  • Update google inc. tensorflow to version 2.3.1.
Affected software
Ecosystem VendorProductAffected versions
pip google tensorflow-gpu 2.2.0
2.3.0
Fix: upgrade to 2.2.1
pip google inc. tensorflow-cpu 2.2.0
2.3.0
Fix: upgrade to 2.2.1
– google tensorflow >= 2.2.0, < 2.2.1
>= 2.3.0, < 2.3.1
cpe:2.3:a:google:tensorflow:*:*:*:*:lite:*:*:*
pip google inc. tensorflow 2.2.0
2.3.0
Fix: upgrade to 2.2.1
Original advisory text
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor....
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `output_data` buffer. This might result in a segmentation fault but it can also be used to further corrupt the memory and can be chained with other vulnerabilities to create more advanced exploits. The issue is patched in commit 204945b19e44b57906c9344c0d00120eeeae178a and is released in TensorFlow versions 2.2.1, or 2.3.1. A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that the segment ids are all positive, although this only handles the case when the segment ids are stored statically in the model. A similar validation could be done if the segment ids are generated at runtime between inference steps. If the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published25 Sep 2020
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-hx2x-85gr-wrpq · GHSA
CVE-2020-15212 · NVD
Track software like this
Free during beta