Every CVE Search/ Get API key

CVE-2020-15208

Data corruption in tensorflow-lite

7.4 HighFix available

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.91%Down 0.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.4

Data corruption in tensorflow-lite

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
CVE-2020-15208
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-125, CWE-787
Updated
2026-11-02
EUVDEUVD-2020-0204 7.4

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
EUVD-2020-0204
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-mxjj-953w-2c2v 8.6

Data corruption in tensorflow-lite

Impact

When determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/types.h#L437-L442

Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors.

Patches

We have patched the issue in 8ee24e7949a20 and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Record
GHSA-mxjj-953w-2c2v
CVSS 4.0
8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-125, CWE-787
Updated
2026-11-02
NVD 7.4

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
CVE-2020-15208
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-125, CWE-787
Updated
2026-11-02
OSV 9.8

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
CVE-2020-15208
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-mxjj-953w-2c2v 8.6

Data corruption in tensorflow-lite

Impact

When determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/types.h#L437-L442

Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors.

Patches

We have patched the issue in 8ee24e7949a20 and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Record
GHSA-mxjj-953w-2c2v
CVSS 4.0
8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-125, CWE-787
Updated
2026-11-02
Show 6 moreShow less
OSVBIT-tensorflow-2020-15208 No score

Data corruption in tensorflow-lite

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
BIT-tensorflow-2020-15208
Updated
2026-11-02
OSVopenSUSE-SU-2020:1766-1 No score

Security update for tensorflow2

This update for tensorflow2 fixes the following issues:

  • updated to 2.1.2 with following fixes (boo#1177022):
    • Fixes an undefined behavior causing a segfault in tf.raw_ops.Switch (CVE-2020-15190)
    • Fixes three vulnerabilities in conversion to DLPack format (CVE-2020-15191, CVE-2020-15192, CVE-2020-15193)
    • Fixes two vulnerabilities in SparseFillEmptyRowsGrad (CVE-2020-15194, CVE-2020-15195)
    • Fixes an integer truncation vulnerability in code using the work sharder API (CVE-2020-15202)
    • Fixes a format string vulnerability in tf.strings.as_string (CVE-2020-15203)
    • Fixes segfault raised by calling session-only ops in eager mode (CVE-2020-15204)
    • Fixes data leak and potential ASLR violation from tf.raw_ops.StringNGrams (CVE-2020-15205)
    • Fixes segfaults caused by incomplete SavedModel validation (CVE-2020-15206)
    • Fixes a data corruption due to a bug in negative indexing support in TFLite (CVE-2020-15207)
    • Fixes a data corruption due to dimension mismatch in TFLite (CVE-2020-15208)
    • Fixes several vulnerabilities in TFLite saved model format (CVE-2020-15209, CVE-2020-15210, CVE-2020-15211)
Record
openSUSE-SU-2020:1766-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12116-1 No score

tensorflow-lite-2.9.1-1.1 on GA media

These are all security issues fixed in the tensorflow-lite-2.9.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12116-1
Updated
2026-11-02
OSVPYSEC-2020-131 No score

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
PYSEC-2020-131
Updated
2026-11-02
OSVPYSEC-2020-288 No score

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
PYSEC-2020-288
Updated
2026-11-02
OSVPYSEC-2020-323 No score

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
PYSEC-2020-323
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tensorflow
PyPI
 before 1.15.4
1.15.4
tensorflow
PyPI
 2.0.0 up to 2.0.3
2.0.3
tensorflow
PyPI
 2.1.0 up to 2.1.2
2.1.2
tensorflow
PyPI
 2.2.0 to 2.2.0
2.2.1
tensorflow
PyPI
 2.3.0 to 2.3.0
2.3.1
tensorflow-cpu
PyPI
 before 1.15.4
1.15.4
tensorflow-cpu
PyPI
 2.0.0 up to 2.0.3
2.0.3
tensorflow-cpu
PyPI
 2.1.0 up to 2.1.2
2.1.2
tensorflow-cpu
PyPI
 2.2.0 to 2.2.0
2.2.1
tensorflow-cpu
PyPI
 2.3.0 to 2.3.0
2.3.1
Show 27 moreShow less
Affected packages
PackageAffectedFixed
tensorflow-gpu
PyPI
 before 1.15.4
1.15.4
tensorflow-gpu
PyPI
 2.0.0 up to 2.0.3
2.0.3
tensorflow-gpu
PyPI
 2.1.0 up to 2.1.2
2.1.2
tensorflow-gpu
PyPI
 2.2.0 to 2.2.0
2.2.1
tensorflow-gpu
PyPI
 2.3.0 to 2.3.0
2.3.1
tensorflow
Bitnami
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1
1.15.42.0.32.1.22.2.12.3.1
tensorflow
PyPI
 before 1.15.4, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 24 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.0
1.15.4
tensorflow
PyPI
 2.0.0 up to 2.0.3, plus listed versions
2.0.12.0.2
2.0.3
tensorflow
PyPI
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2
tensorflow
PyPI
 2.2.0 up to 2.2.1
2.2.1
tensorflow
PyPI
 2.3.0 up to 2.3.1
2.3.1
tensorflow-cpu
PyPI
 before 1.15.4, plus listed versions
1.15.0
1.15.4
tensorflow-cpu
PyPI
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2
tensorflow-cpu
PyPI
 2.2.0 up to 2.2.1
2.2.1
tensorflow-cpu
PyPI
 2.3.0 up to 2.3.1
2.3.1
tensorflow-gpu
PyPI
 before 1.15.4, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 24 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.0
1.15.4
tensorflow-gpu
PyPI
 2.0.0 up to 2.0.3, plus listed versions
2.0.12.0.2
2.0.3
tensorflow-gpu
PyPI
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2
tensorflow-gpu
PyPI
 2.2.0 up to 2.2.1
2.2.1
tensorflow-gpu
PyPI
 2.3.0 up to 2.3.1
2.3.1
tensorflow
PyPI
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions
0.12.0rc00.12.0rc10.12.00.12.11.0.0
Show 45 moreShow less
1.0.11.1.0rc01.1.0rc11.1.0rc21.1.01.2.0rc01.2.0rc11.2.0rc21.2.01.2.11.3.0rc01.3.0rc11.3.0rc21.3.01.4.0rc01.4.0rc11.4.01.4.11.5.0rc01.5.0rc11.5.01.5.11.6.0rc01.6.0rc11.6.01.7.0rc01.7.0rc11.7.01.7.11.8.0rc01.8.0rc11.8.01.9.0rc01.9.0rc11.9.0rc21.9.01.10.0rc01.10.0rc11.10.01.10.11.11.0rc01.11.0rc11.11.0rc21.11.01.12.0rc0
1.15.42.0.32.1.22.2.12.3.1
tensorflow-cpu
PyPI
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions
1.15.02.1.1
1.15.42.0.32.1.22.2.12.3.1
tensorflow-gpu
PyPI
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 27 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.12.0.22.1.1
1.15.42.0.32.1.22.2.12.3.1
tensorflow2
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1
tensorflow2-lite
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1
tensorflow2_2_1_2-gnu-hpc
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1
tensorflow2_2_1_2-gnu-openmpi2-hpc
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-15208 is a high vulnerability (CVSS 7.4) in Google Tensorflow, published September 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in tensorflow 1.15.4.

References

Show 177 moreShow less
This page doesn't list everything

Left out here: 23 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open