CVE-2020-15206 Denial of Service in Tensorflow

Critical 9.0 Published 25 Sep 2020 Updated 4 Aug 2024

Attackers can cause denial of service and data corruption in TensorFlow by manipulating SavedModel protocol buffers, affecting inference services.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-15206?

CVE-2020-15206 is a critical denial of service vulnerability in Google Tensorflow, published on 25 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's `SavedModel` protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using `tensorflow-serving` or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode. The issue is patched in commit adf095206f25471e864a8e63a0f1caef53a0e3a6, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Weakness: CWE-20

Which versions are affected by CVE-2020-15206?

34 open source packages ship an affected version, including tensorflow, tensorflow-cpu and tensorflow-gpu. It affects 2 products.

Package	Affected	Fixed in
`tensorflow` Bitnami	All versions	`1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1`
`tensorflow` PyPI	All versions	`1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1`
`tensorflow` PyPI	All versions	`1.15.4`
`tensorflow` PyPI	All versions	`1.15.4`
`tensorflow` PyPI	From `2.0.0`	`2.0.3`
`tensorflow` PyPI	From `2.0.0`	`2.0.3`

28 more packages

`tensorflow` PyPI	From `2.1.0`	`2.1.2`
`tensorflow` PyPI	From `2.1.0`	`2.1.2`
`tensorflow` PyPI	From `2.2.0`	`2.2.1`
`tensorflow` PyPI	From `2.2.0`	`2.2.1`
`tensorflow` PyPI	From `2.3.0`	`2.3.1`
`tensorflow` PyPI	From `2.3.0`	`2.3.1`
`tensorflow-cpu` PyPI	All versions	`1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1`
`tensorflow-cpu` PyPI	All versions	`1.15.4`
`tensorflow-cpu` PyPI	All versions	`1.15.4`
`tensorflow-cpu` PyPI	From `2.0.0`	`2.0.3`
`tensorflow-cpu` PyPI	From `2.0.0`	`2.0.3`
`tensorflow-cpu` PyPI	From `2.1.0`	`2.1.2`
`tensorflow-cpu` PyPI	From `2.1.0`	`2.1.2`
`tensorflow-cpu` PyPI	From `2.2.0`	`2.2.1`
`tensorflow-cpu` PyPI	From `2.2.0`	`2.2.1`
`tensorflow-cpu` PyPI	From `2.3.0`	`2.3.1`
`tensorflow-cpu` PyPI	From `2.3.0`	`2.3.1`
`tensorflow-gpu` PyPI	All versions	`1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1`
`tensorflow-gpu` PyPI	All versions	`1.15.4`
`tensorflow-gpu` PyPI	All versions	`1.15.4`
`tensorflow-gpu` PyPI	From `2.0.0`	`2.0.3`
`tensorflow-gpu` PyPI	From `2.0.0`	`2.0.3`
`tensorflow-gpu` PyPI	From `2.1.0`	`2.1.2`
`tensorflow-gpu` PyPI	From `2.1.0`	`2.1.2`
`tensorflow-gpu` PyPI	From `2.2.0`	`2.2.1`
`tensorflow-gpu` PyPI	From `2.2.0`	`2.2.1`
`tensorflow-gpu` PyPI	From `2.3.0`	`2.3.1`
`tensorflow-gpu` PyPI	From `2.3.0`	`2.3.1`

Products include Google Tensorflow, Opensuse Leap.

How do I fix CVE-2020-15206?

Upgrade tensorflow to a fixed version for your release line: 1.15.4, 2.0.3, 2.1.2 or 2.2.1.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-15206 being exploited?

There is no known exploitation of CVE-2020-15206 in the wild and no public exploit code.

All Google Tensorflow vulnerabilities

Sources

Also known as BIT-tensorflow-2020-15206, GHSA-w5gh-2wr2-pm6g, PYSEC-2020-129, PYSEC-2020-286, PYSEC-2020-321.