CVE-2020-15193 : Security Advisory and Response

In Tensorflow before versions 2.2.1 and 2.3.1, the implementation of

dlpack.to_dlpack

can be made to use uninitialized memory resulting in further memory corruption. This is because the pybind11 glue code assumes that the argument is a tensor. However, there is nothing stopping users from passing in a Python object instead of a tensor. The uninitialized memory address is due to a

reinterpret_cast

Since the

PyObject

is a Python object, not a TensorFlow Tensor, the cast to

EagerTensor

fails. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1.

Understanding CVE-2020-15193

This CVE involves memory corruption in Tensorflow due to uninitialized memory usage.

What is CVE-2020-15193?

CVE-2020-15193 is a vulnerability in Tensorflow versions 2.2.0 and 2.3.0 that allows the use of uninitialized memory, leading to memory corruption.

The Impact of CVE-2020-15193

The impact of this vulnerability is rated as HIGH severity with a CVSS base score of 7.1. It can result in memory corruption and compromise the integrity of affected systems.

Technical Details of CVE-2020-15193

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The vulnerability arises from the improper handling of uninitialized memory in Tensorflow's

dlpack.to_dlpack

implementation, allowing memory corruption.

Affected Systems and Versions

Product: Tensorflow
Vendor: Tensorflow
Affected Versions: 2.2.0, 2.3.0

Exploitation Mechanism

The vulnerability can be exploited by passing a Python object instead of a tensor to

dlpack.to_dlpack

, causing memory corruption due to uninitialized memory usage.

Mitigation and Prevention

Protecting systems from CVE-2020-15193 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update Tensorflow to versions 2.2.1 or 2.3.1 that contain the patch for this vulnerability.
Monitor for any unusual memory usage or corruption indicators.

Long-Term Security Practices

Regularly update software and libraries to the latest secure versions.
Implement secure coding practices to prevent memory corruption vulnerabilities.

Patching and Updates

Ensure timely application of security patches and updates provided by Tensorflow to mitigate the risk of memory corruption.