Read the docs
TI-2020-11965 Aliases CVE-2020-15193GHSA-rjjg-hgv6-h69v

Memory corruption in Tensorflow

Priority LOW 33CWE-908Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

In Tensorflow before versions 2.2.1 and 2.3.1, the implementation of `dlpack.to_dlpack` can be made to use uninitialized memory resulting in further memory corruption. This is because the pybind11 glue code assumes that the argument is a tensor. However, there is nothing stopping users from passing in a Python object instead of a tensor. The uninitialized memory address is due to a `reinterpret_cast` Since the `PyObject` is a Python object, not a TensorFlow Tensor, the cast to `EagerTensor` fails. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1.

Why it matters now

EPSS 0.0083 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed tensorflow (PyPI): 2.2.1, 2.3.1tensorflow-cpu (PyPI): 2.2.1, 2.3.1+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Googletensorflow= 2.2.0; = 2.3.0—No fix listedCNA
—tensorflow (PyPI)2.2.0 to before 2.2.12.2.1Patch availableGHSA-rjjg-hgv6-h69v
—tensorflow (PyPI)2.3.0 to before 2.3.12.3.1Patch availableGHSA-rjjg-hgv6-h69v
—tensorflow-cpu (PyPI)2.2.0 to before 2.2.12.2.1Patch availableGHSA-rjjg-hgv6-h69v
—tensorflow-cpu (PyPI)2.3.0 to before 2.3.12.3.1Patch availableGHSA-rjjg-hgv6-h69v
—tensorflow-gpu (PyPI)2.2.0 to before 2.2.12.2.1Patch availableGHSA-rjjg-hgv6-h69v
—tensorflow-gpu (PyPI)2.3.0 to before 2.3.12.3.1Patch availableGHSA-rjjg-hgv6-h69v
  • tensorflow VendorGoogle Affected = 2.2.0; = 2.3.0 Fixed in — No fix listed CNA
  • tensorflow (PyPI) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-rjjg-hgv6-h69v
  • tensorflow (PyPI) Vendor— Affected 2.3.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-rjjg-hgv6-h69v
  • tensorflow-cpu (PyPI) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-rjjg-hgv6-h69v
  • tensorflow-cpu (PyPI) Vendor— Affected 2.3.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-rjjg-hgv6-h69v
  • tensorflow-gpu (PyPI) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-rjjg-hgv6-h69v
  • tensorflow-gpu (PyPI) Vendor— Affected 2.3.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-rjjg-hgv6-h69v

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:google:tensorflow:2.2.0:*:*:*:-:*:*:*2.2.0VulnerableGoogle
cpe:2.3:a:google:tensorflow:2.3.0:*:*:*:-:*:*:*2.3.0VulnerableGoogle
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*15.2VulnerableopenSUSE
  • cpe:2.3:a:google:tensorflow:2.2.0:*:*:*:-:*:*:* Versions 2.2.0 Vulnerable ·Google
  • cpe:2.3:a:google:tensorflow:2.3.0:*:*:*:-:*:*:* Versions 2.3.0 Vulnerable ·Google
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE

Remediation

  • Fix · GHSA-rjjg-hgv6-h69v tensorflow (PyPI) Fixed in 2.2.1 Advisory →
  • Fix · GHSA-rjjg-hgv6-h69v tensorflow (PyPI) Fixed in 2.3.1 Advisory →
  • Fix · GHSA-rjjg-hgv6-h69v tensorflow-cpu (PyPI) Fixed in 2.2.1 Advisory →
  • Fix · GHSA-rjjg-hgv6-h69v tensorflow-cpu (PyPI) Fixed in 2.3.1 Advisory →
  • Fix · GHSA-rjjg-hgv6-h69v tensorflow-gpu (PyPI) Fixed in 2.2.1 Advisory →
  • Fix · GHSA-rjjg-hgv6-h69v tensorflow-gpu (PyPI) Fixed in 2.3.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    tensorflow — openSUSE-SU-2020:1766

    16 records Highest priority Priority MEDIUM 6 MEDIUM, 10 LOW

    Other records, highest priority first

    • TI-2020-11980 Data corruption in tensorflow-litePriority MEDIUM 44
    • TI-2020-11977 Data leak in TensorflowPriority MEDIUM 44
    • TI-2020-11979 Segfault and data corruption in tensorflow-litePriority MEDIUM 41
    Show all 16 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15193
  2. 2026-10-03 Alias added: GHSA-rjjg-hgv6-h69v

References

Exploit 1

Patch 1

Advisory 3

Other 4

  • TI-2022-20241 FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess in Tensorflow CVSS 3.1CRITICAL 9.8
  • TI-2022-07640 Integer overflow in Tensorflow CVSS 3.1CRITICAL 9.8
  • TI-2022-07627 Out of bounds read and write in Tensorflow CVSS 3.1HIGH 8.8
  • TI-2022-07619 Out of bounds write in Tensorflow CVSS 3.1HIGH 8.8
  • TI-2022-07613 Read and Write outside of bounds in TFLite CVSS 3.1HIGH 8.8
  • TI-2022-07612 Integer overflow in TFLite CVSS 3.1HIGH 8.8
See all 430 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences