CVE-2020-15192

Advisory

Intel-tensorflow versions 2.2.1 and 2.3.1 include a fix for CVE-2020-15192: In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to 'dlpack.to_dlpack' there is a memory leak following an expected validation failure. The issue occurs because the 'status' argument during validation failures is not properly checked. Since each of the above methods can return an error status, the 'status' value must be checked before continuing.
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8fxw-76px-3rxv

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15192
• https://github.com/tensorflow/tensorflow/commit/22e07fb204386768e5bcbea563641ea11f96ceb8
• https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8fxw-76px-3rxv