CVE-2020-15202CWE-197CWE-754

Integer truncation in Shard API usage

Critical · published September 25, 2020

CVSS v3.1
9.0
EPSS
1%
Percentile
69.9
In the wild
Unconfirmed
What it is

🔥 A sneaky type mismatch in TensorFlow could turn your deep learning dreams into a nightmare! Think of this like a high-speed train running on a track that's too narrow — if it tries to take a tight turn, it can derail spectacularly. In this case, using the wrong data types in the `Shard` API can lead to catastrophic crashes like segfaults or data corruption! An attacker could exploit this vulnerability to cause segfaults or overflow the stack, essentially leading to crashes or corrupting data. This could mean losing critical insights from your models or worse, rendering your whole application useless! The potential for disaster is absolutely devastating!

Put simply

Think of this like a high-speed train running on a track that's too narrow — if it tries to take a tight turn, it can derail spectacularly. In this case, using the wrong data types in the `Shard` API can lead to catastrophic crashes like segfaults or data corruption! This issue arises because the `Shard` API in TensorFlow mistakenly accepts lambda functions with `int` or `int32` arguments instead of the required `int64`. This can result in integer truncation, leading to various severe issues like segfaults and data corruption when handling large workloads.

What to do

An attacker could exploit this vulnerability to cause segfaults or overflow the stack, essentially leading to crashes or corrupting data. This could mean losing critical insights from your models or worse, rendering your whole application useless! The potential for disaster is absolutely devastating! Upgrade your TensorFlow to versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1 immediately to patch this critical vulnerability. Review your code to ensure that all functions used with the `Shard` API are compatible with `int64` arguments. Don't risk your models falling apart! You've got this! Follow these steps and you'll be back on the path to secure and reliable deep learning in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01287 · 69.9th percentile
Weaknesses
CWE-197 · Numeric Truncation Error; CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2020-09-25T18:46Z
EPSS history
Timeline
  • 25 SEP 18:46Z
    Integer truncation in Shard API usage
    cvelistv5