PYSEC-2020-306
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/tensorflow-gpu/PYSEC-2020-306.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2020-306
- Aliases
- Published
- 2020-09-25T19:15:00Z
- Modified
- 2023-12-06T01:00:16.093597Z
- Summary
- [none]
- Details
-
In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to
dlpack.to_dlpackthe expected validations will cause variables to bind tonullptrwhile setting astatusvariable to the error condition. However, thisstatusargument is not properly checked. Hence, code following these methods will bind references to null pointers. This is undefined behavior and reported as an error if compiling with-fsanitize=null. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1. - References
-
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q8qj-fc9q-cphr
- https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1
- https://github.com/tensorflow/tensorflow/commit/22e07fb204386768e5bcbea563641ea11f96ceb8
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html
Affected packages
PyPI / tensorflow-gpu
Package
- Name
- tensorflow-gpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-gpu
Affected ranges
- Type
- GIT
- Repo
- https://github.com/tensorflow/tensorflow
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.2.1Introduced2.3.0rc0Fixed2.3.1
Affected versions
0.*
0.12.0
0.12.1
1.*
1.0.0
1.0.1
1.1.0
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.5.1
1.6.0
1.7.0
1.7.1
1.8.0
1.9.0
1.10.0
1.10.1
1.11.0
1.12.0
1.12.2
1.12.3
1.13.1
1.13.2
1.14.0
1.15.0
1.15.2
1.15.3
1.15.4
1.15.5
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.2.0
2.3.0