p PatchFirst

CVE-2020-26267

CVE-2020-26267 · Lack of validation in data format attributes in TensorFlow

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

CVSS 4.4 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • tensorflow

    Versions
    • < 1.15.5: Affected
    • >= 2.0.0, < 2.0.4: Affected
    • >= 2.1.0, < 2.1.3: Affected
    • >= 2.2.0, < 2.2.2: Affected
    • >= 2.3.0, < 2.3.2: Affected

    No fix published

  • tensorflow PyPI

    Versions
    • 0.12.0
    • 0.12.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.10.0
    • 1.10.1
    • 1.11.0
    • 1.12.0
    • 1.12.2
    • 1.12.3
    • 1.13.1
    • 1.13.2
    • 1.14.0
    • 1.15.0
    • 1.15.2
    • 1.15.3
    • 1.15.4
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.4.0
    • 1.4.1
    • 1.5.0
    • 1.5.1
    • 1.6.0
    • 1.7.0
    • 1.7.1
    • 1.8.0
    • 1.9.0
    Affected ranges
    • ECOSYSTEM: < 1.15.5

    Update to 1.15.5

  • tensorflow PyPI

    Versions
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.0.4

    Update to 2.0.4

  • tensorflow PyPI

    Versions
    • 2.1.0
    • 2.1.1
    • 2.1.2
    Affected ranges
    • ECOSYSTEM: ≥ 2.1.0, < 2.1.3

    Update to 2.1.3

  • tensorflow PyPI

    Versions
    • 2.2.0
    • 2.2.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.2.0, < 2.2.2

    Update to 2.2.2

  • tensorflow PyPI

    Versions
    • 2.3.0
    • 2.3.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0, < 2.3.2

    Update to 2.3.2

  • tensorflow-cpu PyPI

    Versions
    • 1.15.0
    Affected ranges
    • ECOSYSTEM: < 1.15.5

    Update to 1.15.5

  • tensorflow-cpu PyPI

    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.0.4

    Update to 2.0.4

  • tensorflow-cpu PyPI

    Versions
    • 2.1.0
    • 2.1.1
    • 2.1.2
    Affected ranges
    • ECOSYSTEM: ≥ 2.1.0, < 2.1.3

    Update to 2.1.3

  • tensorflow-cpu PyPI

    Versions
    • 2.2.0
    • 2.2.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.2.0, < 2.2.2

    Update to 2.2.2

  • tensorflow-cpu PyPI

    Versions
    • 2.3.0
    • 2.3.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0, < 2.3.2

    Update to 2.3.2

  • tensorflow-gpu PyPI

    Versions
    • 0.12.0
    • 0.12.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.10.0
    • 1.10.1
    • 1.11.0
    • 1.12.0
    • 1.12.2
    • 1.12.3
    • 1.13.1
    • 1.13.2
    • 1.14.0
    • 1.15.0
    • 1.15.2
    • 1.15.3
    • 1.15.4
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.4.0
    • 1.4.1
    • 1.5.0
    • 1.5.1
    • 1.6.0
    • 1.7.0
    • 1.7.1
    • 1.8.0
    • 1.9.0
    Affected ranges
    • ECOSYSTEM: < 1.15.5

    Update to 1.15.5

  • tensorflow-gpu PyPI

    Versions
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.0.4

    Update to 2.0.4

  • tensorflow-gpu PyPI

    Versions
    • 2.1.0
    • 2.1.1
    • 2.1.2
    Affected ranges
    • ECOSYSTEM: ≥ 2.1.0, < 2.1.3

    Update to 2.1.3

  • tensorflow-gpu PyPI

    Versions
    • 2.2.0
    • 2.2.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.2.0, < 2.2.2

    Update to 2.2.2

  • tensorflow-gpu PyPI

    Versions
    • 2.3.0
    • 2.3.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0, < 2.3.2

    Update to 2.3.2

  • tensorflow PyPI

    Versions
    • 0.12.0rc0
    • 0.12.0rc1
    • 0.12.0
    • 0.12.1
    • 1.0.0
    • 1.0.1
    • 1.1.0rc0
    • 1.1.0rc1
    • 1.1.0rc2
    • 1.1.0
    • 1.2.0rc0
    • 1.2.0rc1
    • 1.2.0rc2
    • 1.2.0
    • 1.2.1
    • 1.3.0rc0
    • 1.3.0rc1
    • 1.3.0rc2
    • 1.3.0
    • 1.4.0rc0
    • 1.4.0rc1
    • 1.4.0
    • 1.4.1
    • 1.5.0rc0
    • 1.5.0rc1
    • 1.5.0
    • 1.5.1
    • 1.6.0rc0
    • 1.6.0rc1
    • 1.6.0
    • 1.7.0rc0
    • 1.7.0rc1
    • 1.7.0
    • 1.7.1
    • 1.8.0rc0
    • 1.8.0rc1
    • 1.8.0
    • 1.9.0rc0
    • 1.9.0rc1
    • 1.9.0rc2
    • 1.9.0
    • 1.10.0rc0
    • 1.10.0rc1
    • 1.10.0
    • 1.10.1
    • 1.11.0rc0
    • 1.11.0rc1
    • 1.11.0rc2
    • 1.11.0
    • 1.12.0rc0
    • 1.12.0rc1
    • 1.12.0rc2
    • 1.12.0
    • 1.12.2
    • 1.12.3
    • 1.13.0rc0
    • 1.13.0rc1
    • 1.13.0rc2
    • 1.13.1
    • 1.13.2
    • 1.14.0rc0
    • 1.14.0rc1
    • 1.14.0
    • 1.15.0rc0
    • 1.15.0rc1
    • 1.15.0rc2
    • 1.15.0rc3
    • 1.15.0
    • 1.15.2
    • 1.15.3
    • 1.15.4
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.3.1
    Affected ranges
    • GIT: < ebc70b7a592420d3d2f359e4b1694c236b82c7ae
    • ECOSYSTEM: < 1.15.5 ∪ ≥ 2.0.0, < 2.0.4 ∪ ≥ 2.1.0, < 2.1.3 ∪ ≥ 2.2.0, < 2.2.2 ∪ ≥ 2.3.0, < 2.3.2

    Update to 1.15.5; Update to 2.0.4; Update to 2.1.3; Update to 2.2.2; Update to 2.3.2

  • tensorflow-cpu PyPI

    Versions
    • 1.15.0
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.3.1
    Affected ranges
    • GIT: < ebc70b7a592420d3d2f359e4b1694c236b82c7ae
    • ECOSYSTEM: < 1.15.5 ∪ ≥ 2.0.0, < 2.0.4 ∪ ≥ 2.1.0, < 2.1.3 ∪ ≥ 2.2.0, < 2.2.2 ∪ ≥ 2.3.0, < 2.3.2

    Update to 1.15.5; Update to 2.0.4; Update to 2.1.3; Update to 2.2.2; Update to 2.3.2

  • tensorflow-gpu PyPI

    Versions
    • 0.12.0
    • 0.12.1
    • 1.0.0
    • 1.0.1
    • 1.1.0
    • 1.10.0
    • 1.10.1
    • 1.11.0
    • 1.12.0
    • 1.12.2
    • 1.12.3
    • 1.13.1
    • 1.13.2
    • 1.14.0
    • 1.15.0
    • 1.15.2
    • 1.15.3
    • 1.15.4
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.4.0
    • 1.4.1
    • 1.5.0
    • 1.5.1
    • 1.6.0
    • 1.7.0
    • 1.7.1
    • 1.8.0
    • 1.9.0
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.3.1
    Affected ranges
    • GIT: < ebc70b7a592420d3d2f359e4b1694c236b82c7ae
    • ECOSYSTEM: < 1.15.5 ∪ ≥ 2.0.0, < 2.0.4 ∪ ≥ 2.1.0, < 2.1.3 ∪ ≥ 2.2.0, < 2.2.2 ∪ ≥ 2.3.0, < 2.3.2

    Update to 1.15.5; Update to 2.0.4; Update to 2.1.3; Update to 2.2.2; Update to 2.3.2

Original sources

Check your server →