PyPI: tensorflow-rocm-enhanced
CVE-2020-15191
Safety vulnerability ID: SFTY-20200925-05508
Safety legacy ID: pyup.io-58234
Tensorflow-rocm-enhanced versions 2.2.1 and 2.3.1 include a fix for CVE-2020-15191: In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to 'dlpack.to_dlpack' the expected validations will cause variables to bind to 'nullptr' while setting a 'status' variable to the error condition. However, this 'status' argument is not properly checked. Hence, code following these methods will bind references to null pointers. This is undefined behavior and reported as an error if compiling with '-fsanitize=null'. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q8qj-fc9q-cphr
Overview
Undefined behavior in Tensorflow
Advisory
Tensorflow-rocm-enhanced versions 2.2.1 and 2.3.1 include a fix for CVE-2020-15191: In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to 'dlpack.to_dlpack' the expected validations will cause variables to bind to 'nullptr' while setting a 'status' variable to the error condition. However, this 'status' argument is not properly checked. Hence, code following these methods will bind references to null pointers. This is undefined behavior and reported as an error if compiling with '-fsanitize=null'. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q8qj-fc9q-cphr
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20200925-05508/CVE-2020-15191
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q8qj-fc9q-cphr
- https://github.com/tensorflow/tensorflow/commit/22e07fb204386768e5bcbea563641ea11f96ceb8
- https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1
- https://nvd.nist.gov/vuln/detail/CVE-2020-15191
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-271.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-306.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-114.yaml
- https://github.com/advisories/GHSA-q8qj-fc9q-cphr
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more