CVE Vulnerabilities

CVE-2020-26266

Use of Uninitialized Resource

Published: Dec 10, 2020 | Modified: Dec 14, 2020
CVSS 3.x
5.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 2.x
4.6 MEDIUM
AV:L/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

Weakness

The product uses or accesses a resource that has not been initialized.

Affected Software

Name Vendor Start Version End Version
Tensorflow Google * 1.15.5 (excluding)
Tensorflow Google 2.0.0 (including) 2.0.4 (excluding)
Tensorflow Google 2.1.0 (including) 2.1.3 (excluding)
Tensorflow Google 2.2.0 (including) 2.2.2 (excluding)
Tensorflow Google 2.3.0 (including) 2.3.2 (excluding)

Potential Mitigations

References