CVE-2020-5215

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-5215

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5215.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-5215

Aliases

Related

GHSA-977j-xj7q-2jr9

Published

2020-01-28T22:15:11.090Z

Modified

2026-03-15T14:43:24.918629Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

In TensorFlow before 1.15.2 and 2.0.1, converting a string (from Python) to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inference/training where a malicious attacker can send a data point which contains a string instead of a tf.float16 value. Similar effects can be obtained by manipulating saved models and checkpoints whereby replacing a scalar tf.float16 value with a scalar string will trigger this issue due to automatic conversions. This can be easily reproduced by tf.constant("hello", tf.float16), if eager execution is enabled. This issue is patched in TensorFlow 1.15.1 and 2.0.1 with this vulnerability patched. TensorFlow 2.1.0 was released after we fixed the issue, thus it is not affected. Users are encouraged to switch to TensorFlow 1.15.1, 2.0.1 or 2.1.0.

References

Affected packages

Git / github.com/tensorflow/tensorflow

Affected ranges

Type

GIT

Repo

https://github.com/tensorflow/tensorflow

Events

Introduced

Fixed

5d80e1e8e6ee999be7db39461e0e79c90403a2e4

Introduced

64c3d382cadf7bbe8e7e99884bede8284ff67f56

Fixed

765ac8d16eff6d6ff997ee73809b402d8b1194ae

Fixed

5ac1b9e24ff6afc465756edf845d2e9660bd34bf

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.15.2"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.0.1"
        }
    ]
}

Database specific

vanir_signatures

[
    {
        "digest": {
            "length": 197.0,
            "function_hash": "169491756718983370347084055710880462714"
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2020-5215-2f65c5a3",
        "target": {
            "function": "ConvertScalar",
            "file": "tensorflow/python/lib/core/py_seq_tensor.cc"
        },
        "source": "https://github.com/tensorflow/tensorflow/commit/5ac1b9e24ff6afc465756edf845d2e9660bd34bf"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "119012024491724556604652250412589718169",
                "237227084576023376989014051074680974801",
                "127566177985306014886603074453497343059",
                "116588546924028476433853740919580845958",
                "200310780600779847604580446371257406828",
                "93847000498619289548619176079235354394",
                "104728098562335909513484096576330912108",
                "73580511139890308769548924948362082448",
                "58755134879969402159314086113495162591",
                "9782078360940547244209260823949964113",
                "164903012443669345717525717526426447624",
                "254678185138735732743511734996436577707",
                "332647247333544024785163524307273215918",
                "255155194401183043783334046810606200733",
                "232073086853253169125897111846775267760",
                "183393305189902931528184554552436493206",
                "152724757845698408491708230683505312717",
                "219291339362028777303626789895113802914",
                "105828942998903279080020628777602769332",
                "199727909102925344223063434899511144173",
                "26399827076628370016006416902936540169",
                "43022509404646861400778728583533690548",
                "63041649477159712319227981472757723680",
                "195346844910273332569700470053611296557",
                "8234255108616865316216316139158996228",
                "211856056156421887520781950332685458993",
                "334659155275816189251059591308725044538",
                "147324274740098563333871203261451651242",
                "272207610044661392402039287934294524580",
                "229578991987724368532720703638495430371",
                "266435314610068178723968289032009692368",
                "116198875169680943115303134323197043947",
                "157902972047198089976027550065173686894",
                "31856031216673019846028575765608803630",
                "171638304929510274816999762728143559503"
            ]
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2020-5215-70bbff2d",
        "target": {
            "file": "tensorflow/python/lib/core/py_seq_tensor.cc"
        },
        "source": "https://github.com/tensorflow/tensorflow/commit/5ac1b9e24ff6afc465756edf845d2e9660bd34bf"
    },
    {
        "digest": {
            "length": 2731.0,
            "function_hash": "210234051100349996838581020104485244505"
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2020-5215-87f0e17c",
        "target": {
            "function": "PySeqToTensor",
            "file": "tensorflow/python/lib/core/py_seq_tensor.cc"
        },
        "source": "https://github.com/tensorflow/tensorflow/commit/5ac1b9e24ff6afc465756edf845d2e9660bd34bf"
    },
    {
        "digest": {
            "length": 1174.0,
            "function_hash": "224950308607699489243452055965469347570"
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2020-5215-fdc4c3c5",
        "target": {
            "function": "ConvertOneFloat",
            "file": "tensorflow/python/lib/core/py_seq_tensor.cc"
        },
        "source": "https://github.com/tensorflow/tensorflow/commit/5ac1b9e24ff6afc465756edf845d2e9660bd34bf"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5215.json"