p PatchFirst

CVE-2020-26266

CVE-2020-26266 · Uninitialized memory access in Eigen types in TensorFlow

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

CVSS 4.4 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • tensorflow

    Versions
    • < 1.15.5: Affected
    • >= 2.0.0, < 2.0.4: Affected
    • >= 2.1.0, < 2.1.3: Affected
    • >= 2.2.0, < 2.2.2: Affected
    • >= 2.3.0, < 2.3.2: Affected

    No fix published

  • tensorflow PyPI

    Versions
    • 0.12.0
    • 0.12.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.10.0
    • 1.10.1
    • 1.11.0
    • 1.12.0
    • 1.12.2
    • 1.12.3
    • 1.13.1
    • 1.13.2
    • 1.14.0
    • 1.15.0
    • 1.15.2
    • 1.15.3
    • 1.15.4
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.4.0
    • 1.4.1
    • 1.5.0
    • 1.5.1
    • 1.6.0
    • 1.7.0
    • 1.7.1
    • 1.8.0
    • 1.9.0
    Affected ranges
    • ECOSYSTEM: < 1.15.5

    Update to 1.15.5

  • tensorflow PyPI

    Versions
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.0.4

    Update to 2.0.4

  • tensorflow PyPI

    Versions
    • 2.1.0
    • 2.1.1
    • 2.1.2
    Affected ranges
    • ECOSYSTEM: ≥ 2.1.0, < 2.1.3

    Update to 2.1.3

  • tensorflow PyPI

    Versions
    • 2.2.0
    • 2.2.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.2.0, < 2.2.2

    Update to 2.2.2

  • tensorflow PyPI

    Versions
    • 2.3.0
    • 2.3.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0, < 2.3.2

    Update to 2.3.2

  • tensorflow-cpu PyPI

    Versions
    • 1.15.0
    Affected ranges
    • ECOSYSTEM: < 1.15.5

    Update to 1.15.5

  • tensorflow-cpu PyPI

    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.0.4

    Update to 2.0.4

  • tensorflow-cpu PyPI

    Versions
    • 2.1.0
    • 2.1.1
    • 2.1.2
    Affected ranges
    • ECOSYSTEM: ≥ 2.1.0, < 2.1.3

    Update to 2.1.3

  • tensorflow-cpu PyPI

    Versions
    • 2.2.0
    • 2.2.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.2.0, < 2.2.2

    Update to 2.2.2

  • tensorflow-cpu PyPI

    Versions
    • 2.3.0
    • 2.3.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0, < 2.3.2

    Update to 2.3.2

  • tensorflow-gpu PyPI

    Versions
    • 0.12.0
    • 0.12.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.10.0
    • 1.10.1
    • 1.11.0
    • 1.12.0
    • 1.12.2
    • 1.12.3
    • 1.13.1
    • 1.13.2
    • 1.14.0
    • 1.15.0
    • 1.15.2
    • 1.15.3
    • 1.15.4
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.4.0
    • 1.4.1
    • 1.5.0
    • 1.5.1
    • 1.6.0
    • 1.7.0
    • 1.7.1
    • 1.8.0
    • 1.9.0
    Affected ranges
    • ECOSYSTEM: < 1.15.5

    Update to 1.15.5

  • tensorflow-gpu PyPI

    Versions
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.0.4

    Update to 2.0.4

  • tensorflow-gpu PyPI

    Versions
    • 2.1.0
    • 2.1.1
    • 2.1.2
    Affected ranges
    • ECOSYSTEM: ≥ 2.1.0, < 2.1.3

    Update to 2.1.3

  • tensorflow-gpu PyPI

    Versions
    • 2.2.0
    • 2.2.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.2.0, < 2.2.2

    Update to 2.2.2

  • tensorflow-gpu PyPI

    Versions
    • 2.3.0
    • 2.3.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0, < 2.3.2

    Update to 2.3.2

  • tensorflow PyPI

    Versions
    • 0.12.0
    • 0.12.0rc0
    • 0.12.0rc1
    • 0.12.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.1.0rc0
    • 1.1.0rc1
    • 1.1.0rc2
    • 1.10.0
    • 1.10.0rc0
    • 1.10.0rc1
    • 1.10.1
    • 1.11.0
    • 1.11.0rc0
    • 1.11.0rc1
    • 1.11.0rc2
    • 1.12.0
    • 1.12.0rc0
    • 1.12.0rc1
    • 1.12.0rc2
    • 1.12.2
    • 1.12.3
    • 1.13.0rc0
    • 1.13.0rc1
    • 1.13.0rc2
    • 1.13.1
    • 1.13.2
    • 1.14.0
    • 1.14.0rc0
    • 1.14.0rc1
    • 1.15.0
    • 1.15.0rc0
    • 1.15.0rc1
    • 1.15.0rc2
    • 1.15.0rc3
    • 1.15.2
    • 1.15.3
    • 1.15.4
    • 1.2.0
    • 1.2.0rc0
    • 1.2.0rc1
    • 1.2.0rc2
    • 1.2.1
    • 1.3.0
    • 1.3.0rc0
    • 1.3.0rc1
    • 1.3.0rc2
    • 1.4.0
    • 1.4.0rc0
    • 1.4.0rc1
    • 1.4.1
    • 1.5.0
    • 1.5.0rc0
    • 1.5.0rc1
    • 1.5.1
    • 1.6.0
    • 1.6.0rc0
    • 1.6.0rc1
    • 1.7.0
    • 1.7.0rc0
    • 1.7.0rc1
    • 1.7.1
    • 1.8.0
    • 1.8.0rc0
    • 1.8.0rc1
    • 1.9.0
    • 1.9.0rc0
    • 1.9.0rc1
    • 1.9.0rc2
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.3.1
    Affected ranges
    • GIT: < ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2
    • ECOSYSTEM: < 1.15.5 ∪ ≥ 2.0.0, < 2.0.4 ∪ ≥ 2.1.0, < 2.1.3 ∪ ≥ 2.2.0, < 2.2.2 ∪ ≥ 2.3.0, < 2.3.2

    Update to 1.15.5; Update to 2.0.4; Update to 2.1.3; Update to 2.2.2; Update to 2.3.2

  • tensorflow-cpu PyPI

    Versions
    • 1.15.0
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.3.1
    Affected ranges
    • GIT: < ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2
    • ECOSYSTEM: < 1.15.5 ∪ ≥ 2.0.0, < 2.0.4 ∪ ≥ 2.1.0, < 2.1.3 ∪ ≥ 2.2.0, < 2.2.2 ∪ ≥ 2.3.0, < 2.3.2

    Update to 1.15.5; Update to 2.0.4; Update to 2.1.3; Update to 2.2.2; Update to 2.3.2

  • tensorflow-gpu PyPI

    Versions
    • 0.12.0
    • 0.12.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.10.0
    • 1.10.1
    • 1.11.0
    • 1.12.0
    • 1.12.2
    • 1.12.3
    • 1.13.1
    • 1.13.2
    • 1.14.0
    • 1.15.0
    • 1.15.2
    • 1.15.3
    • 1.15.4
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.4.0
    • 1.4.1
    • 1.5.0
    • 1.5.1
    • 1.6.0
    • 1.7.0
    • 1.7.1
    • 1.8.0
    • 1.9.0
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.3.1
    Affected ranges
    • GIT: < ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2
    • ECOSYSTEM: < 1.15.5 ∪ ≥ 2.0.0, < 2.0.4 ∪ ≥ 2.1.0, < 2.1.3 ∪ ≥ 2.2.0, < 2.2.2 ∪ ≥ 2.3.0, < 2.3.2

    Update to 1.15.5; Update to 2.0.4; Update to 2.1.3; Update to 2.2.2; Update to 2.3.2

Original sources

Check your server →