CVE-2020-15202
CVE-2020-15202 is a critical-severity vulnerability in Google Tensorflow with a CVSS 3.x base score of 9.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-197.
Key facts
- Severity: Critical (CVSS 3.x base score 9.0)
- CVSS v2: 6.8
- EPSS exploit prediction: 1% (65th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-197
- Affected product: Google Tensorflow
- Published:
- Last modified:
Description
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `Shard` API in TensorFlow expects the last argument to be a function taking two `int64` (i.e., `long long`) arguments. However, there are several places in TensorFlow where a lambda taking `int` or `int32` arguments is being used. In these cases, if the amount of work to be parallelized is large enough, integer truncation occurs. Depending on how the two arguments of the lambda are used, this can result in segfaults, read/write outside of heap allocated arrays, stack overflows, or data corruption. The issue is patched in commits 27b417360cbd671ef55915e4bb6bb06af8b8a832 and ca8c013b5e97b1373b3bb1c97ea655e69f31a575, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Frequently asked questions
- What is CVE-2020-15202?
- In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `Shard` API in TensorFlow expects the last argument to be a function taking two `int64` (i.e., `long long`) arguments. However, there are several places in TensorFlow where a lambda taking `int` or `int32` arguments is being used. In these cases, if the amount of work to be parallelized is large enough, integer truncation occurs. Depending on how the two arguments of the lambda are used, this can result in segfaults, read/write outside of heap allocated arrays, stack overflows, or data corruption. The issue is patched in commits 27b417360cbd671ef55915e4bb6bb06af8b8a832 and ca8c013b5e97b1373b3bb1c97ea655e69f31a575, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
- How severe is CVE-2020-15202?
- CVE-2020-15202 has a CVSS 3.x base score of 9.0, rated critical severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2020-15202 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (65th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2020-15202?
- CVE-2020-15202 primarily affects Google Tensorflow. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2020-15202?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2020-15202 published?
- CVE-2020-15202 was published on 2020-09-25 and last updated on 2026-06-17.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html
- https://github.com/tensorflow/tensorflow/commit/27b417360cbd671ef55915e4bb6bb06af8b8a832
- https://github.com/tensorflow/tensorflow/commit/ca8c013b5e97b1373b3bb1c97ea655e69f31a575
- https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h6fg-mjxg-hqq4
Affected products (2)
- cpe:2.3:a:google:tensorflow:*:*:*:*:-:*:*:*
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
More vulnerabilities in Google Tensorflow
- CVE-2023-25668 — Critical (CVSS 9.8): TensorFlow is an open source platform for machine learning. Attackers using Tensorflow prior to 2.12.0 or 2.11.1 can…
- CVE-2018-7575 — Critical (CVSS 9.8): Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. The type of exploitation is…
- CVE-2021-37678 — Critical (CVSS 9.3): TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be…
- CVE-2021-35958 — Critical (CVSS 9.1): TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when…
- CVE-2020-15206 — Critical (CVSS 9.0): In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's `SavedModel` protocol…
- CVE-2020-15205 — Critical (CVSS 9.0): In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `data_splits` argument of…
All CVEs affecting Google Tensorflow →
Other CWE-197 vulnerabilities
- CVE-2024-43639 — Critical (CVSS 9.8): Windows KDC Proxy Remote Code Execution Vulnerability
- CVE-2024-49018 — High (CVSS 8.8): SQL Server Native Client Remote Code Execution Vulnerability
- CVE-2024-43519 — High (CVSS 8.8): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
- CVE-2024-30009 — High (CVSS 8.8): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
- CVE-2023-32143 — High (CVSS 8.8): D-Link DAP-1360 webupg UPGCGI_CheckAuth Numeric Truncation Remote Code Execution Vulnerability. This vulnerability…
- CVE-2024-28944 — High (CVSS 8.8): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability