Resource management error in TensorFlow - CVE-2020-26268

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application. The tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area. If the file is too small, TensorFlow properly returns an error as the memory area has fewer bytes than what is needed for the tensor it creates. However, as soon as there are enough bytes, the above snippet causes a segmentation fault.

Remediation

External links

• https://github.com/tensorflow/tensorflow/commit/c1e1fc899ad5f8c725dcbb6470069890b5060bc7
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hhvc-g5hv-48c6
• https://github.com/tensorflow/tensorflow/releases/tag/v2.3.2
• https://github.com/tensorflow/tensorflow/releases/tag/v2.2.2
• https://github.com/tensorflow/tensorflow/releases/tag/v2.1.3
• https://github.com/tensorflow/tensorflow/releases/tag/v2.0.4
• https://github.com/tensorflow/tensorflow/releases/tag/v1.15.5