CVE-2020-15202

Advisory

Intel-tensorflow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1 include a fix for CVE-2020-15202: In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the 'Shard' API in TensorFlow expects the last argument to be a function taking two 'int64' (i.e., 'long long') arguments. However, there are several places in TensorFlow where a lambda taking 'int' or 'int32' arguments is being used. In these cases, if the amount of work to be parallelized is large enough, integer truncation occurs. Depending on how the two arguments of the lambda are used, this can result in segfaults, read/write outside of heap allocated arrays, stack overflows, or data corruption.
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h6fg-mjxg-hqq4

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15202
• https://github.com/tensorflow/tensorflow/commit/27b417360cbd671ef55915e4bb6bb06af8b8a832
• https://github.com/tensorflow/tensorflow/commit/ca8c013b5e97b1373b3bb1c97ea655e69f31a575
• https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h6fg-mjxg-hqq4