CVE-2020-15194
Denial of Service in Tensorflow
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the SparseFillEmptyRowsGrad implementation has incomplete validation of the shapes of its arguments. Although reverse_index_map_t and grad_values_t are accessed in a similar pattern, only reverse_index_map_t is validated to be of proper shape. Hence, malicious users can pass a bad grad_values_t to trigger an assertion failure in vec, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1."
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Denial of Service in Tensorflow
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the SparseFillEmptyRowsGrad implementation has incomplete validation of the shapes of its arguments. Although reverse_index_map_t and grad_values_t are accessed in a similar pattern, only reverse_index_map_t is validated to be of proper shape. Hence, malicious users can pass a bad grad_values_t to trigger an assertion failure in vec, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1."
- Record
CVE-2020-15194- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-617, CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2020-0190
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the SparseFillEmptyRowsGrad implementation has incomplete validation of the shapes of its arguments. Although reverse_index_map_t and grad_values_t are accessed in a similar pattern, only reverse_index_map_t is validated to be of proper shape. Hence, malicious users can pass a bad grad_values_t to trigger an assertion failure in vec, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1."
- Record
EUVD-2020-0190- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9mqp-7v2h-2382
Denial of Service in Tensorflow
Impact
The SparseFillEmptyRowsGrad implementation has incomplete validation of the shapes of its arguments:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/sparse_fill_empty_rows_op.cc#L235-L241
Although reverse_index_map_t and grad_values_t are accessed in a similar pattern, only reverse_index_map_t is validated to be of proper shape. Hence, malicious users can pass a bad grad_values_t to trigger an assertion failure in vec, causing denial of service in serving installations.
Patches
We have patched the issue in 390611e0d45c5793c7066110af37c8514e6a6c54 and will release a patch release for all affected versions.
We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability is a variant of GHSA-63xm-rx5p-xvqr
- Record
GHSA-9mqp-7v2h-2382- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20, CWE-617
- Updated
- 2026-11-02
NVD
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the SparseFillEmptyRowsGrad implementation has incomplete validation of the shapes of its arguments. Although reverse_index_map_t and grad_values_t are accessed in a similar pattern, only reverse_index_map_t is validated to be of proper shape. Hence, malicious users can pass a bad grad_values_t to trigger an assertion failure in vec, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1."
- Record
CVE-2020-15194- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20, CWE-617
- Updated
- 2026-11-02
OSV
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the SparseFillEmptyRowsGrad implementation has incomplete validation of the shapes of its arguments. Although reverse_index_map_t and grad_values_t are accessed in a similar pattern, only reverse_index_map_t is validated to be of proper shape. Hence, malicious users can pass a bad grad_values_t to trigger an assertion failure in vec, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1."
- Record
CVE-2020-15194- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVGHSA-9mqp-7v2h-2382
Denial of Service in Tensorflow
Impact
The SparseFillEmptyRowsGrad implementation has incomplete validation of the shapes of its arguments:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/sparse_fill_empty_rows_op.cc#L235-L241
Although reverse_index_map_t and grad_values_t are accessed in a similar pattern, only reverse_index_map_t is validated to be of proper shape. Hence, malicious users can pass a bad grad_values_t to trigger an assertion failure in vec, causing denial of service in serving installations.
Patches
We have patched the issue in 390611e0d45c5793c7066110af37c8514e6a6c54 and will release a patch release for all affected versions.
We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability is a variant of GHSA-63xm-rx5p-xvqr
- Record
GHSA-9mqp-7v2h-2382- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20, CWE-617
- Updated
- 2026-11-02
Show 6 moreShow less
OSVBIT-tensorflow-2020-15194 No score
Denial of Service in Tensorflow
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the SparseFillEmptyRowsGrad implementation has incomplete validation of the shapes of its arguments. Although reverse_index_map_t and grad_values_t are accessed in a similar pattern, only reverse_index_map_t is validated to be of proper shape. Hence, malicious users can pass a bad grad_values_t to trigger an assertion failure in vec, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1."
- Record
BIT-tensorflow-2020-15194- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1766-1 No score
Security update for tensorflow2
This update for tensorflow2 fixes the following issues:
- updated to 2.1.2 with following fixes (boo#1177022):
- Fixes an undefined behavior causing a segfault in tf.raw_ops.Switch (CVE-2020-15190)
- Fixes three vulnerabilities in conversion to DLPack format (CVE-2020-15191, CVE-2020-15192, CVE-2020-15193)
- Fixes two vulnerabilities in SparseFillEmptyRowsGrad (CVE-2020-15194, CVE-2020-15195)
- Fixes an integer truncation vulnerability in code using the work sharder API (CVE-2020-15202)
- Fixes a format string vulnerability in tf.strings.as_string (CVE-2020-15203)
- Fixes segfault raised by calling session-only ops in eager mode (CVE-2020-15204)
- Fixes data leak and potential ASLR violation from tf.raw_ops.StringNGrams (CVE-2020-15205)
- Fixes segfaults caused by incomplete SavedModel validation (CVE-2020-15206)
- Fixes a data corruption due to a bug in negative indexing support in TFLite (CVE-2020-15207)
- Fixes a data corruption due to dimension mismatch in TFLite (CVE-2020-15208)
- Fixes several vulnerabilities in TFLite saved model format (CVE-2020-15209, CVE-2020-15210, CVE-2020-15211)
- Record
openSUSE-SU-2020:1766-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12116-1 No score
tensorflow-lite-2.9.1-1.1 on GA media
These are all security issues fixed in the tensorflow-lite-2.9.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12116-1- Updated
- 2026-11-02
OSVPYSEC-2020-117 No score
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the SparseFillEmptyRowsGrad implementation has incomplete validation of the shapes of its arguments. Although reverse_index_map_t and grad_values_t are accessed in a similar pattern, only reverse_index_map_t is validated to be of proper shape. Hence, malicious users can pass a bad grad_values_t to trigger an assertion failure in vec, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1."
- Record
PYSEC-2020-117- Updated
- 2026-11-02
OSVPYSEC-2020-274 No score
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the SparseFillEmptyRowsGrad implementation has incomplete validation of the shapes of its arguments. Although reverse_index_map_t and grad_values_t are accessed in a similar pattern, only reverse_index_map_t is validated to be of proper shape. Hence, malicious users can pass a bad grad_values_t to trigger an assertion failure in vec, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1."
- Record
PYSEC-2020-274- Updated
- 2026-11-02
OSVPYSEC-2020-309 No score
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the SparseFillEmptyRowsGrad implementation has incomplete validation of the shapes of its arguments. Although reverse_index_map_t and grad_values_t are accessed in a similar pattern, only reverse_index_map_t is validated to be of proper shape. Hence, malicious users can pass a bad grad_values_t to trigger an assertion failure in vec, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1."
- Record
PYSEC-2020-309- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tensorflowPyPI |
before 1.15.4 | 1.15.4 |
tensorflowPyPI |
2.0.0 up to 2.0.3 | 2.0.3 |
tensorflowPyPI |
2.1.0 up to 2.1.2 | 2.1.2 |
tensorflowPyPI |
2.2.0 to 2.2.0 | 2.2.1 |
tensorflowPyPI |
2.3.0 to 2.3.0 | 2.3.1 |
tensorflow-cpuPyPI |
before 1.15.4 | 1.15.4 |
tensorflow-cpuPyPI |
2.0.0 up to 2.0.3 | 2.0.3 |
tensorflow-cpuPyPI |
2.1.0 up to 2.1.2 | 2.1.2 |
tensorflow-cpuPyPI |
2.2.0 to 2.2.0 | 2.2.1 |
tensorflow-cpuPyPI |
2.3.0 to 2.3.0 | 2.3.1 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tensorflow-gpuPyPI |
before 1.15.4 | 1.15.4 |
tensorflow-gpuPyPI |
2.0.0 up to 2.0.3 | 2.0.3 |
tensorflow-gpuPyPI |
2.1.0 up to 2.1.2 | 2.1.2 |
tensorflow-gpuPyPI |
2.2.0 to 2.2.0 | 2.2.1 |
tensorflow-gpuPyPI |
2.3.0 to 2.3.0 | 2.3.1 |
tensorflowBitnami |
before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1 | 1.15.42.0.32.1.22.2.12.3.1 |
tensorflowPyPI |
before 1.15.4, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 24 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.0 |
1.15.4 |
tensorflowPyPI |
2.0.0 up to 2.0.3, plus listed versions 2.0.12.0.2 |
2.0.3 |
tensorflowPyPI |
2.1.0 up to 2.1.2, plus listed versions 2.1.1 |
2.1.2 |
tensorflowPyPI |
2.2.0 up to 2.2.1 | 2.2.1 |
tensorflowPyPI |
2.3.0 up to 2.3.1 | 2.3.1 |
tensorflow-cpuPyPI |
before 1.15.4, plus listed versions 1.15.0 |
1.15.4 |
tensorflow-cpuPyPI |
2.1.0 up to 2.1.2, plus listed versions 2.1.1 |
2.1.2 |
tensorflow-cpuPyPI |
2.2.0 up to 2.2.1 | 2.2.1 |
tensorflow-cpuPyPI |
2.3.0 up to 2.3.1 | 2.3.1 |
tensorflow-gpuPyPI |
before 1.15.4, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 24 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.0 |
1.15.4 |
tensorflow-gpuPyPI |
2.0.0 up to 2.0.3, plus listed versions 2.0.12.0.2 |
2.0.3 |
tensorflow-gpuPyPI |
2.1.0 up to 2.1.2, plus listed versions 2.1.1 |
2.1.2 |
tensorflow-gpuPyPI |
2.2.0 up to 2.2.1 | 2.2.1 |
tensorflow-gpuPyPI |
2.3.0 up to 2.3.1 | 2.3.1 |
tensorflowPyPI |
before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions 0.12.0rc00.12.0rc10.12.00.12.11.0.0 Show 45 moreShow less1.0.11.1.0rc01.1.0rc11.1.0rc21.1.01.2.0rc01.2.0rc11.2.0rc21.2.01.2.11.3.0rc01.3.0rc11.3.0rc21.3.01.4.0rc01.4.0rc11.4.01.4.11.5.0rc01.5.0rc11.5.01.5.11.6.0rc01.6.0rc11.6.01.7.0rc01.7.0rc11.7.01.7.11.8.0rc01.8.0rc11.8.01.9.0rc01.9.0rc11.9.0rc21.9.01.10.0rc01.10.0rc11.10.01.10.11.11.0rc01.11.0rc11.11.0rc21.11.01.12.0rc0 |
1.15.42.0.32.1.22.2.12.3.1 |
tensorflow-cpuPyPI |
before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions 1.15.02.1.1 |
1.15.42.0.32.1.22.2.12.3.1 |
tensorflow-gpuPyPI |
before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 27 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.12.0.22.1.1 |
1.15.42.0.32.1.22.2.12.3.1 |
tensorflow2openSUSE:Leap 15.2 From an advisory covering 16 CVEs |
before 2.1.2-lp152.7.3.1 | 2.1.2-lp152.7.3.1 |
tensorflow2-liteopenSUSE:Leap 15.2 From an advisory covering 16 CVEs |
before 2.1.2-lp152.7.3.1 | 2.1.2-lp152.7.3.1 |
tensorflow2_2_1_2-gnu-hpcopenSUSE:Leap 15.2 From an advisory covering 16 CVEs |
before 2.1.2-lp152.7.3.1 | 2.1.2-lp152.7.3.1 |
tensorflow2_2_1_2-gnu-openmpi2-hpcopenSUSE:Leap 15.2 From an advisory covering 16 CVEs |
before 2.1.2-lp152.7.3.1 | 2.1.2-lp152.7.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-15194 is a medium vulnerability (CVSS 5.3) in Google Tensorflow, published September 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 63rd percentile. Fixed in tensorflow 1.15.4.
References
github.com/tensorflow/tensorflow/releases/tag/v2.3.1
lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html
nvd.nist.gov/vuln/detail/CVE-2020-15194
Show 177 moreShow less
bugzilla.suse.com/1173314
suse.com/security/cve/CVE-2020-15190
Left out here: 23 versions. The JSON record has them.