GHSA-8fxw-76px-3rxv
Suggest an improvement- Source
- https://github.com/advisories/GHSA-8fxw-76px-3rxv
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-8fxw-76px-3rxv/GHSA-8fxw-76px-3rxv.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-8fxw-76px-3rxv
- Aliases
- Published
- 2020-09-25T18:28:17Z
- Modified
- 2024-10-28T20:06:09Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Memory leak in Tensorflow
- Details
-
Impact
If a user passes a list of strings to
dlpack.to_dlpackthere is a memory leak following an expected validation failure: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L100-L104The allocated memory is from https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L256
The issue occurs because the
statusargument during validation failures is not properly checked: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L265-L267Since each of the above methods can return an error status, the
statusvalue must be checked before continuing.Patches
We have patched the issue in 22e07fb204386768e5bcbea563641ea11f96ceb8 and will release a patch release for all affected versions.
We recommend users to upgrade to TensorFlow 2.2.1 or 2.3.1.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been discovered during variant analysis of GHSA-rjjg-hgv6-h69v.
- Database specific
{ "nvd_published_at": "2020-09-25T19:15:00Z", "cwe_ids": [ "CWE-20" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2020-09-25T16:22:58Z" }- References
-
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8fxw-76px-3rxv
- https://nvd.nist.gov/vuln/detail/CVE-2020-15192
- https://github.com/tensorflow/tensorflow/commit/22e07fb204386768e5bcbea563641ea11f96ceb8
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-272.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-307.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-115.yaml
- https://github.com/tensorflow/tensorflow
- https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html
Affected packages
PyPI / tensorflow
Package
- Name
- tensorflow
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow
PyPI / tensorflow
Package
- Name
- tensorflow
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow
PyPI / tensorflow-cpu
Package
- Name
- tensorflow-cpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-cpu
PyPI / tensorflow-cpu
Package
- Name
- tensorflow-cpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-cpu
PyPI / tensorflow-gpu
Package
- Name
- tensorflow-gpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-gpu
PyPI / tensorflow-gpu
Package
- Name
- tensorflow-gpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-gpu