Every CVE Search/ Get API key

CVE-2020-15205

Data leak in Tensorflow

9.0 CriticalFix available

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the data_splits argument of tf.raw_ops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after ee ff are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR. The issue is patched in commit 0462de5b544ed4731aa2fb23946ac22c01856b80, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.03%Unchanged since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 9.0

Data leak in Tensorflow

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the data_splits argument of tf.raw_ops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after ee ff are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR. The issue is patched in commit 0462de5b544ed4731aa2fb23946ac22c01856b80, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
CVE-2020-15205
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-122, CWE-119
Updated
2026-11-02
EUVDEUVD-2020-0201 9.0

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the data_splits argument of tf.raw_ops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after ee ff are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR. The issue is patched in commit 0462de5b544ed4731aa2fb23946ac22c01856b80, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
EUVD-2020-0201
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-g7p5-5759-qv46 6.5

Data leak in Tensorflow

Impact

The data_splits argument of tf.raw_ops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory

>>> tf.raw_ops.StringNGrams(data=["aa", "bb", "cc", "dd", "ee", "ff"], data_splits=[0,8], separator=" ", ngram_widths=[3], left_pad="", right_pad="", pad_width=0, preserve_short_sequences=False)
StringNGrams(ngrams=<tf.Tensor: shape=(6,), dtype=string, numpy=
array([b'aa bb cc', b'bb cc dd', b'cc dd ee', b'dd ee ff',
       b'ee ff \xf4j\xa7q\x7f\x00\x00q\x00\x00\x00\x00\x00\x00\x00\xd8\x9b~\xa8q\x7f\x00',
       b'ff \xf4j\xa7q\x7f\x00\x00q\x00\x00\x00\x00\x00\x00\x00\xd8\x9b~\xa8q\x7f\x00 \x9b~\xa8q\x7f\x00\x00p\xf5j\xa7q\x7f\x00\x00H\xf8j\xa7q\x7f\x00\x00\xf0\xf3\xf7\x85q\x7f\x00\x00`}\xa6\x00\x00\x00\x00\x00`~\xa6\x00\x00\x00\x00\x00\xb0~\xeb\x9bq\x7f\x00'],...

All the binary strings after ee ff are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR.

Patches

We have patched the issue in 0462de5b544ed4731aa2fb23946ac22c01856b80 and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Record
GHSA-g7p5-5759-qv46
CVSS 4.0
6.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-119, CWE-122, CWE-787
Updated
2026-11-02
NVD 9.0

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the data_splits argument of tf.raw_ops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after ee ff are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR. The issue is patched in commit 0462de5b544ed4731aa2fb23946ac22c01856b80, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
CVE-2020-15205
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119, CWE-122, CWE-787
Updated
2026-11-02
OSV 9.8

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the data_splits argument of tf.raw_ops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after ee ff are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR. The issue is patched in commit 0462de5b544ed4731aa2fb23946ac22c01856b80, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
CVE-2020-15205
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-g7p5-5759-qv46 6.5

Data leak in Tensorflow

Impact

The data_splits argument of tf.raw_ops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory

>>> tf.raw_ops.StringNGrams(data=["aa", "bb", "cc", "dd", "ee", "ff"], data_splits=[0,8], separator=" ", ngram_widths=[3], left_pad="", right_pad="", pad_width=0, preserve_short_sequences=False)
StringNGrams(ngrams=<tf.Tensor: shape=(6,), dtype=string, numpy=
array([b'aa bb cc', b'bb cc dd', b'cc dd ee', b'dd ee ff',
       b'ee ff \xf4j\xa7q\x7f\x00\x00q\x00\x00\x00\x00\x00\x00\x00\xd8\x9b~\xa8q\x7f\x00',
       b'ff \xf4j\xa7q\x7f\x00\x00q\x00\x00\x00\x00\x00\x00\x00\xd8\x9b~\xa8q\x7f\x00 \x9b~\xa8q\x7f\x00\x00p\xf5j\xa7q\x7f\x00\x00H\xf8j\xa7q\x7f\x00\x00\xf0\xf3\xf7\x85q\x7f\x00\x00`}\xa6\x00\x00\x00\x00\x00`~\xa6\x00\x00\x00\x00\x00\xb0~\xeb\x9bq\x7f\x00'],...

All the binary strings after ee ff are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR.

Patches

We have patched the issue in 0462de5b544ed4731aa2fb23946ac22c01856b80 and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Record
GHSA-g7p5-5759-qv46
CVSS 4.0
6.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-119, CWE-122, CWE-787
Updated
2026-11-02
Show 6 moreShow less
OSVBIT-tensorflow-2020-15205 No score

Data leak in Tensorflow

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the data_splits argument of tf.raw_ops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after ee ff are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR. The issue is patched in commit 0462de5b544ed4731aa2fb23946ac22c01856b80, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
BIT-tensorflow-2020-15205
Updated
2026-11-02
OSVopenSUSE-SU-2020:1766-1 No score

Security update for tensorflow2

This update for tensorflow2 fixes the following issues:

  • updated to 2.1.2 with following fixes (boo#1177022):
    • Fixes an undefined behavior causing a segfault in tf.raw_ops.Switch (CVE-2020-15190)
    • Fixes three vulnerabilities in conversion to DLPack format (CVE-2020-15191, CVE-2020-15192, CVE-2020-15193)
    • Fixes two vulnerabilities in SparseFillEmptyRowsGrad (CVE-2020-15194, CVE-2020-15195)
    • Fixes an integer truncation vulnerability in code using the work sharder API (CVE-2020-15202)
    • Fixes a format string vulnerability in tf.strings.as_string (CVE-2020-15203)
    • Fixes segfault raised by calling session-only ops in eager mode (CVE-2020-15204)
    • Fixes data leak and potential ASLR violation from tf.raw_ops.StringNGrams (CVE-2020-15205)
    • Fixes segfaults caused by incomplete SavedModel validation (CVE-2020-15206)
    • Fixes a data corruption due to a bug in negative indexing support in TFLite (CVE-2020-15207)
    • Fixes a data corruption due to dimension mismatch in TFLite (CVE-2020-15208)
    • Fixes several vulnerabilities in TFLite saved model format (CVE-2020-15209, CVE-2020-15210, CVE-2020-15211)
Record
openSUSE-SU-2020:1766-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12116-1 No score

tensorflow-lite-2.9.1-1.1 on GA media

These are all security issues fixed in the tensorflow-lite-2.9.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12116-1
Updated
2026-11-02
OSVPYSEC-2020-128 No score

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the data_splits argument of tf.raw_ops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after ee ff are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR. The issue is patched in commit 0462de5b544ed4731aa2fb23946ac22c01856b80, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
PYSEC-2020-128
Updated
2026-11-02
OSVPYSEC-2020-285 No score

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the data_splits argument of tf.raw_ops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after ee ff are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR. The issue is patched in commit 0462de5b544ed4731aa2fb23946ac22c01856b80, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
PYSEC-2020-285
Updated
2026-11-02
OSVPYSEC-2020-320 No score

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the data_splits argument of tf.raw_ops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after ee ff are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR. The issue is patched in commit 0462de5b544ed4731aa2fb23946ac22c01856b80, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
PYSEC-2020-320
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tensorflow
PyPI
 before 1.15.4
1.15.4
tensorflow
PyPI
 2.0.0 up to 2.0.3
2.0.3
tensorflow
PyPI
 2.1.0 up to 2.1.2
2.1.2
tensorflow
PyPI
 2.2.0 to 2.2.0
2.2.1
tensorflow
PyPI
 2.3.0 to 2.3.0
2.3.1
tensorflow-cpu
PyPI
 before 1.15.4
1.15.4
tensorflow-cpu
PyPI
 2.0.0 up to 2.0.3
2.0.3
tensorflow-cpu
PyPI
 2.1.0 up to 2.1.2
2.1.2
tensorflow-cpu
PyPI
 2.2.0 to 2.2.0
2.2.1
tensorflow-cpu
PyPI
 2.3.0 to 2.3.0
2.3.1
Show 27 moreShow less
Affected packages
PackageAffectedFixed
tensorflow-gpu
PyPI
 before 1.15.4
1.15.4
tensorflow-gpu
PyPI
 2.0.0 up to 2.0.3
2.0.3
tensorflow-gpu
PyPI
 2.1.0 up to 2.1.2
2.1.2
tensorflow-gpu
PyPI
 2.2.0 to 2.2.0
2.2.1
tensorflow-gpu
PyPI
 2.3.0 to 2.3.0
2.3.1
tensorflow
Bitnami
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1
1.15.42.0.32.1.22.2.12.3.1
tensorflow
PyPI
 before 1.15.4, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 24 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.0
1.15.4
tensorflow
PyPI
 2.0.0 up to 2.0.3, plus listed versions
2.0.12.0.2
2.0.3
tensorflow
PyPI
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2
tensorflow
PyPI
 2.2.0 up to 2.2.1
2.2.1
tensorflow
PyPI
 2.3.0 up to 2.3.1
2.3.1
tensorflow-cpu
PyPI
 before 1.15.4, plus listed versions
1.15.0
1.15.4
tensorflow-cpu
PyPI
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2
tensorflow-cpu
PyPI
 2.2.0 up to 2.2.1
2.2.1
tensorflow-cpu
PyPI
 2.3.0 up to 2.3.1
2.3.1
tensorflow-gpu
PyPI
 before 1.15.4, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 24 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.0
1.15.4
tensorflow-gpu
PyPI
 2.0.0 up to 2.0.3, plus listed versions
2.0.12.0.2
2.0.3
tensorflow-gpu
PyPI
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2
tensorflow-gpu
PyPI
 2.2.0 up to 2.2.1
2.2.1
tensorflow-gpu
PyPI
 2.3.0 up to 2.3.1
2.3.1
tensorflow
PyPI
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions
0.12.0rc00.12.0rc10.12.00.12.11.0.0
Show 45 moreShow less
1.0.11.1.0rc01.1.0rc11.1.0rc21.1.01.2.0rc01.2.0rc11.2.0rc21.2.01.2.11.3.0rc01.3.0rc11.3.0rc21.3.01.4.0rc01.4.0rc11.4.01.4.11.5.0rc01.5.0rc11.5.01.5.11.6.0rc01.6.0rc11.6.01.7.0rc01.7.0rc11.7.01.7.11.8.0rc01.8.0rc11.8.01.9.0rc01.9.0rc11.9.0rc21.9.01.10.0rc01.10.0rc11.10.01.10.11.11.0rc01.11.0rc11.11.0rc21.11.01.12.0rc0
1.15.42.0.32.1.22.2.12.3.1
tensorflow-cpu
PyPI
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions
1.15.02.1.1
1.15.42.0.32.1.22.2.12.3.1
tensorflow-gpu
PyPI
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 27 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.12.0.22.1.1
1.15.42.0.32.1.22.2.12.3.1
tensorflow2
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1
tensorflow2-lite
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1
tensorflow2_2_1_2-gnu-hpc
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1
tensorflow2_2_1_2-gnu-openmpi2-hpc
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-15205 is a critical vulnerability (CVSS 9.0) in Google Tensorflow, published September 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 63rd percentile. Fixed in tensorflow 1.15.4.

References

Show 177 moreShow less
This page doesn't list everything

Left out here: 23 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open