CVE-2020-15266

Advisory

Tensorflow-rocm 2.4.0 includes a fix for CVE-2020-15266: In Tensorflow before version 2.4.0, when the 'boxes' argument of 'tf.image.crop_and_resize' has a very large value, the CPU kernel implementation receives it as a C++ 'nan' floating point value. Attempting to operate on this is undefined behavior which later produces a segmentation fault.
https://github.com/tensorflow/tensorflow/issues/42129
https://github.com/tensorflow/tensorflow/pull/42143/commits/3ade2efec2e90c6237de32a19680caaa3ebc2845
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xwhf-g6j5-j5gc

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15266
• https://github.com/tensorflow/tensorflow/issues/42129
• https://github.com/tensorflow/tensorflow/pull/42143/commits/3ade2efec2e90c6237de32a19680caaa3ebc2845
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xwhf-g6j5-j5gc