- Description
- In eager mode, TensorFlow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1 does not set the session state. Hence, calling `tf.raw_ops.GetSessionHandle` or `tf.raw_ops.GetSessionHandleV2` results in a null pointer dereference In linked snippet, in eager mode, `ctx->session_state()` returns `nullptr`. Since code immediately dereferences this, we get a segmentation fault. The issue is patched in commit 9a133d73ae4b4664d22bd1aa6d654fec13c52ee1, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:tensorflow:*:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC688B44-17B7-462D-B6E3-BAAF99334782",
"versionEndExcluding": "1.15.4"
},
{
"criteria": "cpe:2.3:a:google:tensorflow:*:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6271763-8DFA-4A8F-9596-F1148961ECC5",
"versionEndExcluding": "2.0.3",
"versionStartIncluding": "2.0.0"
},
{
"criteria": "cpe:2.3:a:google:tensorflow:*:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AA3FD62B-13CB-4EB5-939F-C848DE9AE071",
"versionEndExcluding": "2.1.2",
"versionStartIncluding": "2.1.0"
},
{
"criteria": "cpe:2.3:a:google:tensorflow:*:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "029CB8A9-ED3D-486D-967C-4CE0AF8D8FAD",
"versionEndExcluding": "2.2.1",
"versionStartIncluding": "2.2.0"
},
{
"criteria": "cpe:2.3:a:google:tensorflow:*:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B617650A-B5A1-44BB-BB3A-2EF83648B100",
"versionEndExcluding": "2.3.1",
"versionStartIncluding": "2.3.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A"
}
],
"operator": "OR"
}
]
}
]