CVE-2020-26271

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-26271

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-26271.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2020-26271

Aliases

Downstream

openSUSE-SU-2022:10014-1

Related

Published

2020-12-10T22:15:12.077Z

Modified

2026-02-13T08:35:55.366718Z

Severity

3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

In affected versions of TensorFlow under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The MakeEdge function creates an edge between one output tensor of the src node (given by outputindex) and the input slot of the dst node (given by inputindex). This is only possible if the types of the tensors on both sides coincide, so the function begins by obtaining the corresponding DataType values and comparing these for equality. However, there is no check that the indices point to inside of the arrays they index into. Thus, this can result in accessing data out of bounds of the corresponding heap allocated arrays. In most scenarios, this can manifest as unitialized data access, but if the index points far away from the boundaries of the arrays this can be used to leak addresses from the library. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

References

Affected packages

Git / github.com/tensorflow/tensorflow

Affected ranges

Type: GIT
Repo: https://github.com/tensorflow/tensorflow
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

0cc38aaa4064fd9e79101994ce9872c6d91f816b

Introduced

2b96f3662bd776e277f86997659e61046b56c315

Fixed

d745ff2a48cebf18e847e8b602a744e97e058946

Introduced

64c3d382cadf7bbe8e7e99884bede8284ff67f56

Fixed

cdf2c541c3dd3fb6d03cce4d23fc6c548bc9017c

Introduced

b36436b087bd8e8701ef51718179037cccdfc26e

Fixed

9edbe5075f79a4a95ed14a2be831f9b59e61f49d

Introduced

e5bf8de410005de06a7ff5393fafdf832ef1d4ad

Fixed

77f47d6ed6ca1f50b6f2c4919097e625d50398a9

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-26271.json"

vanir_signatures

[
    {
        "digest": {
            "function_hash": "160474403644703465032814885090362751013",
            "length": 529.0
        },
        "signature_version": "v1",
        "target": {
            "file": "tensorflow/core/common_runtime/graph_constructor.cc",
            "function": "GraphConstructor::MakeEdge"
        },
        "signature_type": "Function",
        "id": "CVE-2020-26271-1918f3b8",
        "source": "https://github.com/tensorflow/tensorflow/commit/0cc38aaa4064fd9e79101994ce9872c6d91f816b",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "246302249073193558975993325200968311008",
                "63112483980140233714391676694701056481",
                "72813380224672222722792523327400720531",
                "109224518461182228557436876205457738808",
                "107942194748794950554986205189495345936",
                "242914202284517432901184786043833814054",
                "308921242018771160633452228931529883494",
                "142920717307188956548218146900145462585"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "tensorflow/core/common_runtime/graph_constructor.cc"
        },
        "signature_type": "Line",
        "id": "CVE-2020-26271-fa090181",
        "source": "https://github.com/tensorflow/tensorflow/commit/0cc38aaa4064fd9e79101994ce9872c6d91f816b",
        "deprecated": false
    }
]