Null pointer dereference in tensorflow-lite
Priority LOW 28CWE-476Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-476.
Summary
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with `nullptr`. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Why it matters now
EPSS 0.008 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed tensorflow (tensorflow): 1.15.4, 2.0.3, 2.1.2 +2tensorflow (PyPI): 1.15.4, 2.0.3, 2.1.2 +2+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tensorflow | before 1.15.4; 2.0.0 to before 2.0.3; 2.1.0 to before 2.1.2; 2.2.0 to before 2.2.1; 2.3.0 to before 2.3.1 | 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1 | Patch available | CNA | |
| — | tensorflow (PyPI) | before 1.15.4 | 1.15.4 | Patch available | GHSA-qh32-6jjc-qprm |
| — | tensorflow (PyPI) | 2.0.0 to before 2.0.3 | 2.0.3 | Patch available | GHSA-qh32-6jjc-qprm |
| — | tensorflow (PyPI) | 2.1.0 to before 2.1.2 | 2.1.2 | Patch available | GHSA-qh32-6jjc-qprm |
| — | tensorflow (PyPI) | 2.2.0 to before 2.2.1 | 2.2.1 | Patch available | GHSA-qh32-6jjc-qprm |
| — | tensorflow (PyPI) | 2.3.0 to before 2.3.1 | 2.3.1 | Patch available | GHSA-qh32-6jjc-qprm |
| — | tensorflow-cpu (PyPI) | before 1.15.4 | 1.15.4 | Patch available | GHSA-qh32-6jjc-qprm |
| — | tensorflow-cpu (PyPI) | 2.0.0 to before 2.0.3 | 2.0.3 | Patch available | GHSA-qh32-6jjc-qprm |
| — | tensorflow-cpu (PyPI) | 2.1.0 to before 2.1.2 | 2.1.2 | Patch available | GHSA-qh32-6jjc-qprm |
| — | tensorflow-cpu (PyPI) | 2.2.0 to before 2.2.1 | 2.2.1 | Patch available | GHSA-qh32-6jjc-qprm |
| — | tensorflow-cpu (PyPI) | 2.3.0 to before 2.3.1 | 2.3.1 | Patch available | GHSA-qh32-6jjc-qprm |
| — | tensorflow-gpu (PyPI) | before 1.15.4 | 1.15.4 | Patch available | GHSA-qh32-6jjc-qprm |
| — | tensorflow-gpu (PyPI) | 2.0.0 to before 2.0.3 | 2.0.3 | Patch available | GHSA-qh32-6jjc-qprm |
| — | tensorflow-gpu (PyPI) | 2.1.0 to before 2.1.2 | 2.1.2 | Patch available | GHSA-qh32-6jjc-qprm |
| — | tensorflow-gpu (PyPI) | 2.2.0 to before 2.2.1 | 2.2.1 | Patch available | GHSA-qh32-6jjc-qprm |
| — | tensorflow-gpu (PyPI) | 2.3.0 to before 2.3.1 | 2.3.1 | Patch available | GHSA-qh32-6jjc-qprm |
- tensorflow VendorGoogle Affected before 1.15.4; 2.0.0 to before 2.0.3; 2.1.0 to before 2.1.2; 2.2.0 to before 2.2.1; 2.3.0 to before 2.3.1 Fixed in 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1 Patch available CNA
- tensorflow (PyPI) Vendor— Affected before 1.15.4 Fixed in 1.15.4 Patch available GHSA-qh32-6jjc-qprm
- tensorflow (PyPI) Vendor— Affected 2.0.0 to before 2.0.3 Fixed in 2.0.3 Patch available GHSA-qh32-6jjc-qprm
- tensorflow (PyPI) Vendor— Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-qh32-6jjc-qprm
- tensorflow (PyPI) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-qh32-6jjc-qprm
- tensorflow (PyPI) Vendor— Affected 2.3.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-qh32-6jjc-qprm
- tensorflow-cpu (PyPI) Vendor— Affected before 1.15.4 Fixed in 1.15.4 Patch available GHSA-qh32-6jjc-qprm
- tensorflow-cpu (PyPI) Vendor— Affected 2.0.0 to before 2.0.3 Fixed in 2.0.3 Patch available GHSA-qh32-6jjc-qprm
- tensorflow-cpu (PyPI) Vendor— Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-qh32-6jjc-qprm
- tensorflow-cpu (PyPI) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-qh32-6jjc-qprm
- tensorflow-cpu (PyPI) Vendor— Affected 2.3.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-qh32-6jjc-qprm
- tensorflow-gpu (PyPI) Vendor— Affected before 1.15.4 Fixed in 1.15.4 Patch available GHSA-qh32-6jjc-qprm
- tensorflow-gpu (PyPI) Vendor— Affected 2.0.0 to before 2.0.3 Fixed in 2.0.3 Patch available GHSA-qh32-6jjc-qprm
- tensorflow-gpu (PyPI) Vendor— Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-qh32-6jjc-qprm
- tensorflow-gpu (PyPI) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-qh32-6jjc-qprm
- tensorflow-gpu (PyPI) Vendor— Affected 2.3.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-qh32-6jjc-qprm
Remediation
- Fix · CNA tensorflow (tensorflow) Fixed in 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1
- Fix · GHSA-qh32-6jjc-qprm tensorflow (PyPI) Fixed in 1.15.4 Advisory →
- Fix · GHSA-qh32-6jjc-qprm tensorflow (PyPI) Fixed in 2.0.3 Advisory →
- Fix · GHSA-qh32-6jjc-qprm tensorflow (PyPI) Fixed in 2.1.2 Advisory →
- Fix · GHSA-qh32-6jjc-qprm tensorflow (PyPI) Fixed in 2.2.1 Advisory →
- Fix · GHSA-qh32-6jjc-qprm tensorflow (PyPI) Fixed in 2.3.1 Advisory →
- Fix · GHSA-qh32-6jjc-qprm tensorflow-cpu (PyPI) Fixed in 1.15.4 Advisory →
- Fix · GHSA-qh32-6jjc-qprm tensorflow-cpu (PyPI) Fixed in 2.0.3 Advisory →
- Fix · GHSA-qh32-6jjc-qprm tensorflow-cpu (PyPI) Fixed in 2.1.2 Advisory →
- Fix · GHSA-qh32-6jjc-qprm tensorflow-cpu (PyPI) Fixed in 2.2.1 Advisory →
- Fix · GHSA-qh32-6jjc-qprm tensorflow-cpu (PyPI) Fixed in 2.3.1 Advisory →
- Fix · GHSA-qh32-6jjc-qprm tensorflow-gpu (PyPI) Fixed in 1.15.4 Advisory →
- Fix · GHSA-qh32-6jjc-qprm tensorflow-gpu (PyPI) Fixed in 2.0.3 Advisory →
- Fix · GHSA-qh32-6jjc-qprm tensorflow-gpu (PyPI) Fixed in 2.1.2 Advisory →
- Fix · GHSA-qh32-6jjc-qprm tensorflow-gpu (PyPI) Fixed in 2.2.1 Advisory →
- Fix · GHSA-qh32-6jjc-qprm tensorflow-gpu (PyPI) Fixed in 2.3.1 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
tensorflow — openSUSE-SU-2020:1766
16 records Highest priority Priority MEDIUM 6 MEDIUM, 10 LOW
Other records, highest priority first
- TI-2020-11980 Data corruption in tensorflow-litePriority MEDIUM 44
- TI-2020-11977 Data leak in TensorflowPriority MEDIUM 44
- TI-2020-11979 Segfault and data corruption in tensorflow-litePriority MEDIUM 41
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15209
- 2026-10-03 Alias added: GHSA-qh32-6jjc-qprm
References
Advisory 3
Other 4
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-289.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-324.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-132.yaml
- https://github.com/tensorflow/tensorflow
More Google Tensorflow vulnerabilities
- TI-2022-20241 FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess in Tensorflow CVSS 3.1CRITICAL 9.8
- TI-2022-07640 Integer overflow in Tensorflow CVSS 3.1CRITICAL 9.8
- TI-2022-07627 Out of bounds read and write in Tensorflow CVSS 3.1HIGH 8.8
- TI-2022-07619 Out of bounds write in Tensorflow CVSS 3.1HIGH 8.8
- TI-2022-07613 Read and Write outside of bounds in TFLite CVSS 3.1HIGH 8.8
- TI-2022-07612 Integer overflow in TFLite CVSS 3.1HIGH 8.8
Sources
- CVE-2020-15209 · CVE Program
- CVE-2020-15209 · NVD
- FIRST EPSS
- GHSA-qh32-6jjc-qprm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences