CVE-2020-26266

Advisory

Tensorflow-cpu versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0 includes a fix for CVE-2020-26266: In affected versions and under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26266
• https://github.com/tensorflow/tensorflow/commit/ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qhxx-j73r-qpm2