{"data":{"id":"6c0bec16-fee8-40ab-afaa-3735d185c2b7","title":"CVE-2020-15214: In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a write out bounds /…","summary":"In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a write out of bounds or a segmentation fault when segment ids are not sorted. The code assumes increasing order and sizes the output tensor from the last element, so it allocates too little memory and writes past the output array. The write can serve as a write gadget in future memory corruption exploits.","solution":"Fixed in TensorFlow versions 2.2.1 and 2.3.1 (patch commit 204945b19e44b57906c9344c0d00120eeeae178a). Workaround for statically stored segment ids: add a custom `Verifier` to the model loading code to ensure the segment ids are sorted. A similar validation can be run on segment ids generated at runtime between inference steps. If segment ids are generated as outputs of a tensor during inference, there is no workaround and users should upgrade to patched code.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-15214","publishedAt":"2020-09-25T23:15:16.713Z","cveId":"CVE-2020-15214","cweIds":["CWE-787"],"cvssScore":"8.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["tensorflow@= 2.2.0 (fixed: 2.2.1)","tensorflow@= 2.3.0 (fixed: 2.3.1)","tensorflow-cpu@= 2.2.0 (fixed: 2.2.1)","tensorflow-cpu@= 2.3.0 (fixed: 2.3.1)","tensorflow-gpu@= 2.2.0 (fixed: 2.2.1)","tensorflow-gpu@= 2.3.0 (fixed: 2.3.1)"],"affectedPackageNames":["tensorflow","tensorflow-cpu","tensorflow-gpu"],"affectedPackageRefs":["pypi:tensorflow","pypi:tensorflow-cpu","pypi:tensorflow-gpu"],"affectedVendors":["Google"],"affectedVendorsRaw":["TensorFlow Lite"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"TensorFlow Lite out of bounds write in segment sum with unsorted segment ids","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00671,"epssCheckedAt":"2026-11-04T06:10:15.975Z","kevDateAdded":null,"advisoryAliases":["GHSA-p2cq-cprg-frvm"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T04:00:53.540Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2020-09-24T19:03:23.545Z","daysToFix":-1,"fixCheckedAt":"2026-10-29T21:52:33.828Z","capecIds":["CAPEC-100"],"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.3.1","matchedVersion":"2.3.1","fixReleasedAt":"2020-09-24T19:32:56.435Z","daysToFix":-1,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:52:33.670Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.3.1","matchedVersion":"2.3.1","fixReleasedAt":"2020-09-24T19:29:12.073Z","daysToFix":-1,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:52:33.670Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.2.1","matchedVersion":"2.2.1","fixReleasedAt":"2020-09-24T19:03:23.545Z","daysToFix":-1,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:52:33.670Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.2.1","matchedVersion":"2.2.1","fixReleasedAt":"2020-09-24T19:11:29.089Z","daysToFix":-1,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:52:33.670Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.3.1","matchedVersion":"2.3.1","fixReleasedAt":"2020-09-24T19:23:11.978Z","daysToFix":-1,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:52:33.670Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.2.1","matchedVersion":"2.2.1","fixReleasedAt":"2020-09-24T19:16:14.398Z","daysToFix":-1,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:52:33.670Z"}]}}