CVE-2020-15191

Advisory

Tensorflow-gpu versions 2.2.1 and 2.3.1 include a fix for CVE-2020-15191: In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to 'dlpack.to_dlpack' the expected validations will cause variables to bind to 'nullptr' while setting a 'status' variable to the error condition. However, this 'status' argument is not properly checked. Hence, code following these methods will bind references to null pointers. This is undefined behavior and reported as an error if compiling with '-fsanitize=null'.
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q8qj-fc9q-cphr

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15191
• https://github.com/tensorflow/tensorflow/commit/22e07fb204386768e5bcbea563641ea11f96ceb8
• https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q8qj-fc9q-cphr