CVE-2020-15203
Denial of Service in Tensorflow
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the fill argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Denial of Service in Tensorflow
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the fill argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
- Record
CVE-2020-15203- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2020-0199
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the fill argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
- Record
EUVD-2020-0199- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xmq7-7fxm-rr79
Denial of Service in Tensorflow
Impact
By controlling the fill argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/as_string_op.cc#L68-L74
This can result in unexpected output:
In [1]: tf.strings.as_string(input=[1234], width=6, fill='-')
Out[1]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['1234 '], dtype=object)>
In [2]: tf.strings.as_string(input=[1234], width=6, fill='+')
Out[2]: <tf.Tensor: shape=(1,), dtype=string, numpy=array([' +1234'], dtype=object)>
In [3]: tf.strings.as_string(input=[1234], width=6, fill="h")
Out[3]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['%6d'], dtype=object)>
In [4]: tf.strings.as_string(input=[1234], width=6, fill="d")
Out[4]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['12346d'], dtype=object)>
In [5]: tf.strings.as_string(input=[1234], width=6, fill="o")
Out[5]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['23226d'], dtype=object)>
In [6]: tf.strings.as_string(input=[1234], width=6, fill="x")
Out[6]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['4d26d'], dtype=object)>
In [7]: tf.strings.as_string(input=[1234], width=6, fill="g")
Out[7]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['8.67458e-3116d'], dtype=object)>
In [8]: tf.strings.as_string(input=[1234], width=6, fill="a")
Out[8]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['0x0.00ff7eebb4d4p-10226d'], dtype=object)>
In [9]: tf.strings.as_string(input=[1234], width=6, fill="c")
Out[9]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['\xd26d'], dtype=object)>
In [10]: tf.strings.as_string(input=[1234], width=6, fill="p")
Out[10]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['0x4d26d'], dtype=object)>
In [11]: tf.strings.as_string(input=[1234], width=6, fill='m')
Out[11]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['Success6d'], dtype=object)>
However, passing in n or s results in segmentation fault.
Patches
We have patched the issue in 33be22c65d86256e6826666662e40dbdfe70ee83 and will release patch releases for all versions between 1.15 and 2.3.
We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
- Record
GHSA-xmq7-7fxm-rr79- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-134
- Updated
- 2026-11-02
NVD
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the fill argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
- Record
CVE-2020-15203- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20, CWE-134
- Updated
- 2026-11-02
OSV
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the fill argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
- Record
CVE-2020-15203- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-xmq7-7fxm-rr79
Denial of Service in Tensorflow
Impact
By controlling the fill argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/as_string_op.cc#L68-L74
This can result in unexpected output:
In [1]: tf.strings.as_string(input=[1234], width=6, fill='-')
Out[1]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['1234 '], dtype=object)>
In [2]: tf.strings.as_string(input=[1234], width=6, fill='+')
Out[2]: <tf.Tensor: shape=(1,), dtype=string, numpy=array([' +1234'], dtype=object)>
In [3]: tf.strings.as_string(input=[1234], width=6, fill="h")
Out[3]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['%6d'], dtype=object)>
In [4]: tf.strings.as_string(input=[1234], width=6, fill="d")
Out[4]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['12346d'], dtype=object)>
In [5]: tf.strings.as_string(input=[1234], width=6, fill="o")
Out[5]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['23226d'], dtype=object)>
In [6]: tf.strings.as_string(input=[1234], width=6, fill="x")
Out[6]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['4d26d'], dtype=object)>
In [7]: tf.strings.as_string(input=[1234], width=6, fill="g")
Out[7]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['8.67458e-3116d'], dtype=object)>
In [8]: tf.strings.as_string(input=[1234], width=6, fill="a")
Out[8]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['0x0.00ff7eebb4d4p-10226d'], dtype=object)>
In [9]: tf.strings.as_string(input=[1234], width=6, fill="c")
Out[9]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['\xd26d'], dtype=object)>
In [10]: tf.strings.as_string(input=[1234], width=6, fill="p")
Out[10]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['0x4d26d'], dtype=object)>
In [11]: tf.strings.as_string(input=[1234], width=6, fill='m')
Out[11]: <tf.Tensor: shape=(1,), dtype=string, numpy=array(['Success6d'], dtype=object)>
However, passing in n or s results in segmentation fault.
Patches
We have patched the issue in 33be22c65d86256e6826666662e40dbdfe70ee83 and will release patch releases for all versions between 1.15 and 2.3.
We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
- Record
GHSA-xmq7-7fxm-rr79- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-134, CWE-20
- Updated
- 2026-11-02
Show 6 moreShow less
OSVBIT-tensorflow-2020-15203 No score
Denial of Service in Tensorflow
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the fill argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
- Record
BIT-tensorflow-2020-15203- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1766-1 No score
Security update for tensorflow2
This update for tensorflow2 fixes the following issues:
- updated to 2.1.2 with following fixes (boo#1177022):
- Fixes an undefined behavior causing a segfault in tf.raw_ops.Switch (CVE-2020-15190)
- Fixes three vulnerabilities in conversion to DLPack format (CVE-2020-15191, CVE-2020-15192, CVE-2020-15193)
- Fixes two vulnerabilities in SparseFillEmptyRowsGrad (CVE-2020-15194, CVE-2020-15195)
- Fixes an integer truncation vulnerability in code using the work sharder API (CVE-2020-15202)
- Fixes a format string vulnerability in tf.strings.as_string (CVE-2020-15203)
- Fixes segfault raised by calling session-only ops in eager mode (CVE-2020-15204)
- Fixes data leak and potential ASLR violation from tf.raw_ops.StringNGrams (CVE-2020-15205)
- Fixes segfaults caused by incomplete SavedModel validation (CVE-2020-15206)
- Fixes a data corruption due to a bug in negative indexing support in TFLite (CVE-2020-15207)
- Fixes a data corruption due to dimension mismatch in TFLite (CVE-2020-15208)
- Fixes several vulnerabilities in TFLite saved model format (CVE-2020-15209, CVE-2020-15210, CVE-2020-15211)
- Record
openSUSE-SU-2020:1766-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12116-1 No score
tensorflow-lite-2.9.1-1.1 on GA media
These are all security issues fixed in the tensorflow-lite-2.9.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12116-1- Updated
- 2026-11-02
OSVPYSEC-2020-126 No score
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the fill argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
- Record
PYSEC-2020-126- Updated
- 2026-11-02
OSVPYSEC-2020-283 No score
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the fill argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
- Record
PYSEC-2020-283- Updated
- 2026-11-02
OSVPYSEC-2020-318 No score
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the fill argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
- Record
PYSEC-2020-318- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tensorflowPyPI |
before 1.15.4 | 1.15.4 |
tensorflowPyPI |
2.0.0 up to 2.0.3 | 2.0.3 |
tensorflowPyPI |
2.1.0 up to 2.1.2 | 2.1.2 |
tensorflowPyPI |
2.2.0 to 2.2.0 | 2.2.1 |
tensorflowPyPI |
2.3.0 to 2.3.0 | 2.3.1 |
tensorflow-cpuPyPI |
before 1.15.4 | 1.15.4 |
tensorflow-cpuPyPI |
2.0.0 up to 2.0.3 | 2.0.3 |
tensorflow-cpuPyPI |
2.1.0 up to 2.1.2 | 2.1.2 |
tensorflow-cpuPyPI |
2.2.0 to 2.2.0 | 2.2.1 |
tensorflow-cpuPyPI |
2.3.0 to 2.3.0 | 2.3.1 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tensorflow-gpuPyPI |
before 1.15.4 | 1.15.4 |
tensorflow-gpuPyPI |
2.0.0 up to 2.0.3 | 2.0.3 |
tensorflow-gpuPyPI |
2.1.0 up to 2.1.2 | 2.1.2 |
tensorflow-gpuPyPI |
2.2.0 to 2.2.0 | 2.2.1 |
tensorflow-gpuPyPI |
2.3.0 to 2.3.0 | 2.3.1 |
tensorflowBitnami |
before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1 | 1.15.42.0.32.1.22.2.12.3.1 |
tensorflowPyPI |
before 1.15.4, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 24 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.0 |
1.15.4 |
tensorflowPyPI |
2.0.0 up to 2.0.3, plus listed versions 2.0.12.0.2 |
2.0.3 |
tensorflowPyPI |
2.1.0 up to 2.1.2, plus listed versions 2.1.1 |
2.1.2 |
tensorflowPyPI |
2.2.0 up to 2.2.1 | 2.2.1 |
tensorflowPyPI |
2.3.0 up to 2.3.1 | 2.3.1 |
tensorflow-cpuPyPI |
before 1.15.4, plus listed versions 1.15.0 |
1.15.4 |
tensorflow-cpuPyPI |
2.1.0 up to 2.1.2, plus listed versions 2.1.1 |
2.1.2 |
tensorflow-cpuPyPI |
2.2.0 up to 2.2.1 | 2.2.1 |
tensorflow-cpuPyPI |
2.3.0 up to 2.3.1 | 2.3.1 |
tensorflow-gpuPyPI |
before 1.15.4, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 24 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.0 |
1.15.4 |
tensorflow-gpuPyPI |
2.0.0 up to 2.0.3, plus listed versions 2.0.12.0.2 |
2.0.3 |
tensorflow-gpuPyPI |
2.1.0 up to 2.1.2, plus listed versions 2.1.1 |
2.1.2 |
tensorflow-gpuPyPI |
2.2.0 up to 2.2.1 | 2.2.1 |
tensorflow-gpuPyPI |
2.3.0 up to 2.3.1 | 2.3.1 |
tensorflowPyPI |
before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions 0.12.0rc00.12.0rc10.12.00.12.11.0.0 Show 45 moreShow less1.0.11.1.0rc01.1.0rc11.1.0rc21.1.01.2.0rc01.2.0rc11.2.0rc21.2.01.2.11.3.0rc01.3.0rc11.3.0rc21.3.01.4.0rc01.4.0rc11.4.01.4.11.5.0rc01.5.0rc11.5.01.5.11.6.0rc01.6.0rc11.6.01.7.0rc01.7.0rc11.7.01.7.11.8.0rc01.8.0rc11.8.01.9.0rc01.9.0rc11.9.0rc21.9.01.10.0rc01.10.0rc11.10.01.10.11.11.0rc01.11.0rc11.11.0rc21.11.01.12.0rc0 |
1.15.42.0.32.1.22.2.12.3.1 |
tensorflow-cpuPyPI |
before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions 1.15.02.1.1 |
1.15.42.0.32.1.22.2.12.3.1 |
tensorflow-gpuPyPI |
before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 27 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.12.0.22.1.1 |
1.15.42.0.32.1.22.2.12.3.1 |
tensorflow2openSUSE:Leap 15.2 From an advisory covering 16 CVEs |
before 2.1.2-lp152.7.3.1 | 2.1.2-lp152.7.3.1 |
tensorflow2-liteopenSUSE:Leap 15.2 From an advisory covering 16 CVEs |
before 2.1.2-lp152.7.3.1 | 2.1.2-lp152.7.3.1 |
tensorflow2_2_1_2-gnu-hpcopenSUSE:Leap 15.2 From an advisory covering 16 CVEs |
before 2.1.2-lp152.7.3.1 | 2.1.2-lp152.7.3.1 |
tensorflow2_2_1_2-gnu-openmpi2-hpcopenSUSE:Leap 15.2 From an advisory covering 16 CVEs |
before 2.1.2-lp152.7.3.1 | 2.1.2-lp152.7.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-15203 is a high vulnerability (CVSS 7.5) in Google Tensorflow, published September 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 61st percentile. Fixed in tensorflow 1.15.4.
References
github.com/tensorflow/tensorflow/releases/tag/v2.3.1
lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html
nvd.nist.gov/vuln/detail/CVE-2020-15203
Show 177 moreShow less
bugzilla.suse.com/1173314
suse.com/security/cve/CVE-2020-15190
Left out here: 23 versions. The JSON record has them.