gsd-2020-26270
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.
Aliases
Aliases
CVE-2020-26270


To clipboard 

{
  "GSD": {
    "alias": "CVE-2020-26270",
    "description": "In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.",
    "id": "GSD-2020-26270",
    "references": [
      "https://www.suse.com/security/cve/CVE-2020-26270.html",
      "https://security.archlinux.org/CVE-2020-26270"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-26270"
      ],
      "details": "In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.",
      "id": "GSD-2020-26270",
      "modified": "2023-12-13T01:22:09.219444Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2020-26270",
        "STATE": "PUBLIC",
        "TITLE": "CHECK-fail in LSTM with zero-length input in TensorFlow"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "tensorflow",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 1.15.5"
                        },
                        {
                          "version_value": "\u003e= 2.0.0, \u003c 2.0.4"
                        },
                        {
                          "version_value": "\u003e= 2.1.0, \u003c 2.1.3"
                        },
                        {
                          "version_value": "\u003e= 2.2.0, \u003c 2.2.2"
                        },
                        {
                          "version_value": "\u003e= 2.3.0, \u003c 2.3.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "tensorflow"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 4.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-20 Improper Input Validation"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m648-33qf-v3gp",
            "refsource": "CONFIRM",
            "url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m648-33qf-v3gp"
          },
          {
            "name": "https://github.com/tensorflow/tensorflow/commit/14755416e364f17fb1870882fa778c7fec7f16e3",
            "refsource": "MISC",
            "url": "https://github.com/tensorflow/tensorflow/commit/14755416e364f17fb1870882fa778c7fec7f16e3"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-m648-33qf-v3gp",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,1.15.5),[2.0.0,2.0.4),[2.1.0,2.1.3),[2.2.0,2.2.2),[2.3.0,2.3.2)",
          "affected_versions": "All versions before 1.15.5, all versions starting from 2.0.0 before 2.0.4, all versions starting from 2.1.0 before 2.1.3, all versions starting from 2.2.0 before 2.2.2, all versions starting from 2.3.0 before 2.3.2",
          "cvss_v2": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "cwe_ids": [
            "CWE-1035",
            "CWE-20",
            "CWE-937"
          ],
          "date": "2020-12-14",
          "description": "In affected versions of TensorFlow running an `LSTM/GRU` model where the `LSTM/GRU` layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer.",
          "fixed_versions": [],
          "identifier": "CVE-2020-26270",
          "identifiers": [
            "CVE-2020-26270",
            "GHSA-m648-33qf-v3gp"
          ],
          "not_impacted": "",
          "package_slug": "maven/org.tensorflow/parentpom",
          "pubdate": "2020-12-10",
          "solution": "Unfortunately, there is no solution available yet.",
          "title": "Improper Input Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-26270"
          ],
          "uuid": "01c64304-d2bb-4cb7-857c-14f9856d2137"
        },
        {
          "affected_range": "\u003c1.15.5||\u003e=2.0.0,\u003c2.0.4||\u003e=2.1.0,\u003c2.1.3||\u003e=2.2.0,\u003c2.2.2||\u003e=2.3.0,\u003c2.3.2",
          "affected_versions": "All versions before 1.15.5, all versions starting from 2.0.0 before 2.0.4, all versions starting from 2.1.0 before 2.1.3, all versions starting from 2.2.0 before 2.2.2, all versions starting from 2.3.0 before 2.3.2",
          "cvss_v2": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "cwe_ids": [
            "CWE-1035",
            "CWE-20",
            "CWE-937"
          ],
          "date": "2021-01-07",
          "description": "In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.",
          "fixed_versions": [
            "1.15.5",
            "2.0.4",
            "2.1.3",
            "2.2.2",
            "2.3.2"
          ],
          "identifier": "CVE-2020-26270",
          "identifiers": [
            "GHSA-m648-33qf-v3gp",
            "CVE-2020-26270"
          ],
          "not_impacted": "All versions starting from 1.15.5 before 2.0.0, all versions starting from 2.0.4 before 2.1.0, all versions starting from 2.1.3 before 2.2.0, all versions starting from 2.2.2 before 2.3.0, all versions starting from 2.3.2",
          "package_slug": "pypi/tensorflow-cpu",
          "pubdate": "2020-12-10",
          "solution": "Upgrade to versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m648-33qf-v3gp",
            "https://github.com/tensorflow/tensorflow/commit/14755416e364f17fb1870882fa778c7fec7f16e3",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-26270",
            "https://github.com/advisories/GHSA-m648-33qf-v3gp"
          ],
          "uuid": "8597a3b9-c055-4d58-8152-8bc4fee51963"
        },
        {
          "affected_range": "\u003c1.15.5||\u003e=2.0.0,\u003c2.0.4||\u003e=2.1.0,\u003c2.1.3||\u003e=2.2.0,\u003c2.2.2||\u003e=2.3.0,\u003c2.3.2",
          "affected_versions": "All versions before 1.15.5, all versions starting from 2.0.0 before 2.0.4, all versions starting from 2.1.0 before 2.1.3, all versions starting from 2.2.0 before 2.2.2, all versions starting from 2.3.0 before 2.3.2",
          "cvss_v2": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "cwe_ids": [
            "CWE-1035",
            "CWE-20",
            "CWE-937"
          ],
          "date": "2021-01-07",
          "description": "In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.",
          "fixed_versions": [
            "1.15.5",
            "2.0.4",
            "2.1.3",
            "2.2.2",
            "2.3.2"
          ],
          "identifier": "CVE-2020-26270",
          "identifiers": [
            "GHSA-m648-33qf-v3gp",
            "CVE-2020-26270"
          ],
          "not_impacted": "All versions starting from 1.15.5 before 2.0.0, all versions starting from 2.0.4 before 2.1.0, all versions starting from 2.1.3 before 2.2.0, all versions starting from 2.2.2 before 2.3.0, all versions starting from 2.3.2",
          "package_slug": "pypi/tensorflow-gpu",
          "pubdate": "2020-12-10",
          "solution": "Upgrade to versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m648-33qf-v3gp",
            "https://github.com/tensorflow/tensorflow/commit/14755416e364f17fb1870882fa778c7fec7f16e3",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-26270",
            "https://github.com/advisories/GHSA-m648-33qf-v3gp"
          ],
          "uuid": "c688062d-6581-4b89-99c3-79f77642fa40"
        },
        {
          "affected_range": "\u003c1.15.5||\u003e=2.0.0,\u003c2.0.4||\u003e=2.1.0,\u003c2.1.3||\u003e=2.2.0,\u003c2.2.2||\u003e=2.3.0,\u003c2.3.2",
          "affected_versions": "All versions before 1.15.5, all versions starting from 2.0.0 before 2.0.4, all versions starting from 2.1.0 before 2.1.3, all versions starting from 2.2.0 before 2.2.2, all versions starting from 2.3.0 before 2.3.2",
          "cvss_v2": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
          "cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "cwe_ids": [
            "CWE-1035",
            "CWE-20",
            "CWE-937"
          ],
          "date": "2020-12-14",
          "description": "In affected versions of TensorFlow running an `LSTM/GRU` model where the `LSTM/GRU` layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer.",
          "fixed_versions": [
            "2.4.0"
          ],
          "identifier": "CVE-2020-26270",
          "identifiers": [
            "CVE-2020-26270",
            "GHSA-m648-33qf-v3gp"
          ],
          "not_impacted": "All versions starting from 1.15.5 before 2.0.0, all versions starting from 2.0.4 before 2.1.0, all versions starting from 2.1.3 before 2.2.0, all versions starting from 2.2.2 before 2.3.0, all versions starting from 2.3.2",
          "package_slug": "pypi/tensorflow",
          "pubdate": "2020-12-10",
          "solution": "Upgrade to version 2.4.0 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-26270"
          ],
          "uuid": "d15773ea-4352-4f61-b82c-34b32beef425"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.15.5",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.0.4",
                "versionStartIncluding": "2.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.1.3",
                "versionStartIncluding": "2.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.2.2",
                "versionStartIncluding": "2.2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.3.2",
                "versionStartIncluding": "2.3.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-26270"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m648-33qf-v3gp",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m648-33qf-v3gp"
            },
            {
              "name": "https://github.com/tensorflow/tensorflow/commit/14755416e364f17fb1870882fa778c7fec7f16e3",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/tensorflow/tensorflow/commit/14755416e364f17fb1870882fa778c7fec7f16e3"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 2.1,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2020-12-14T17:33Z",
      "publishedDate": "2020-12-10T23:15Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.