Every CVE Search/ Get API key

CVE-2020-15209

Null pointer dereference in tensorflow-lite

5.9 MediumFix available

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a nullptr buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with nullptr. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.80%Down 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.9

Null pointer dereference in tensorflow-lite

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a nullptr buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with nullptr. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
CVE-2020-15209
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2020-0205 5.9

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a nullptr buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with nullptr. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
EUVD-2020-0205
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-qh32-6jjc-qprm 8.2

Null pointer dereference in tensorflow-lite

Impact

A crafted TFLite model can force a node to have as input a tensor backed by a nullptr buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with nullptr: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/core/subgraph.cc#L1224-L1227

However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference.

Patches

We have patched the issue in 0b5662bc and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by members of the Aivul Team from Qihoo 360 but was also discovered through variant analysis of GHSA-cvpc-8phh-8f45.

Record
GHSA-qh32-6jjc-qprm
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
NVD 5.9

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a nullptr buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with nullptr. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
CVE-2020-15209
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
OSV 5.9

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a nullptr buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with nullptr. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
CVE-2020-15209
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-qh32-6jjc-qprm 8.2

Null pointer dereference in tensorflow-lite

Impact

A crafted TFLite model can force a node to have as input a tensor backed by a nullptr buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with nullptr: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/core/subgraph.cc#L1224-L1227

However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference.

Patches

We have patched the issue in 0b5662bc and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by members of the Aivul Team from Qihoo 360 but was also discovered through variant analysis of GHSA-cvpc-8phh-8f45.

Record
GHSA-qh32-6jjc-qprm
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
Show 6 moreShow less
OSVBIT-tensorflow-2020-15209 No score

Null pointer dereference in tensorflow-lite

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a nullptr buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with nullptr. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
BIT-tensorflow-2020-15209
Updated
2026-11-02
OSVopenSUSE-SU-2020:1766-1 No score

Security update for tensorflow2

This update for tensorflow2 fixes the following issues:

  • updated to 2.1.2 with following fixes (boo#1177022):
    • Fixes an undefined behavior causing a segfault in tf.raw_ops.Switch (CVE-2020-15190)
    • Fixes three vulnerabilities in conversion to DLPack format (CVE-2020-15191, CVE-2020-15192, CVE-2020-15193)
    • Fixes two vulnerabilities in SparseFillEmptyRowsGrad (CVE-2020-15194, CVE-2020-15195)
    • Fixes an integer truncation vulnerability in code using the work sharder API (CVE-2020-15202)
    • Fixes a format string vulnerability in tf.strings.as_string (CVE-2020-15203)
    • Fixes segfault raised by calling session-only ops in eager mode (CVE-2020-15204)
    • Fixes data leak and potential ASLR violation from tf.raw_ops.StringNGrams (CVE-2020-15205)
    • Fixes segfaults caused by incomplete SavedModel validation (CVE-2020-15206)
    • Fixes a data corruption due to a bug in negative indexing support in TFLite (CVE-2020-15207)
    • Fixes a data corruption due to dimension mismatch in TFLite (CVE-2020-15208)
    • Fixes several vulnerabilities in TFLite saved model format (CVE-2020-15209, CVE-2020-15210, CVE-2020-15211)
Record
openSUSE-SU-2020:1766-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12116-1 No score

tensorflow-lite-2.9.1-1.1 on GA media

These are all security issues fixed in the tensorflow-lite-2.9.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12116-1
Updated
2026-11-02
OSVPYSEC-2020-132 No score

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a nullptr buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with nullptr. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
PYSEC-2020-132
Updated
2026-11-02
OSVPYSEC-2020-289 No score

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a nullptr buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with nullptr. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
PYSEC-2020-289
Updated
2026-11-02
OSVPYSEC-2020-324 No score

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a nullptr buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with nullptr. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Record
PYSEC-2020-324
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tensorflow
PyPI
 before 1.15.4
1.15.4
tensorflow
PyPI
 2.0.0 up to 2.0.3
2.0.3
tensorflow
PyPI
 2.1.0 up to 2.1.2
2.1.2
tensorflow
PyPI
 2.2.0 to 2.2.0
2.2.1
tensorflow
PyPI
 2.3.0 to 2.3.0
2.3.1
tensorflow-cpu
PyPI
 before 1.15.4
1.15.4
tensorflow-cpu
PyPI
 2.0.0 up to 2.0.3
2.0.3
tensorflow-cpu
PyPI
 2.1.0 up to 2.1.2
2.1.2
tensorflow-cpu
PyPI
 2.2.0 to 2.2.0
2.2.1
tensorflow-cpu
PyPI
 2.3.0 to 2.3.0
2.3.1
Show 27 moreShow less
Affected packages
PackageAffectedFixed
tensorflow-gpu
PyPI
 before 1.15.4
1.15.4
tensorflow-gpu
PyPI
 2.0.0 up to 2.0.3
2.0.3
tensorflow-gpu
PyPI
 2.1.0 up to 2.1.2
2.1.2
tensorflow-gpu
PyPI
 2.2.0 to 2.2.0
2.2.1
tensorflow-gpu
PyPI
 2.3.0 to 2.3.0
2.3.1
tensorflow
Bitnami
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1
1.15.42.0.32.1.22.2.12.3.1
tensorflow
PyPI
 before 1.15.4, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 24 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.0
1.15.4
tensorflow
PyPI
 2.0.0 up to 2.0.3, plus listed versions
2.0.12.0.2
2.0.3
tensorflow
PyPI
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2
tensorflow
PyPI
 2.2.0 up to 2.2.1
2.2.1
tensorflow
PyPI
 2.3.0 up to 2.3.1
2.3.1
tensorflow-cpu
PyPI
 before 1.15.4, plus listed versions
1.15.0
1.15.4
tensorflow-cpu
PyPI
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2
tensorflow-cpu
PyPI
 2.2.0 up to 2.2.1
2.2.1
tensorflow-cpu
PyPI
 2.3.0 up to 2.3.1
2.3.1
tensorflow-gpu
PyPI
 before 1.15.4, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 24 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.0
1.15.4
tensorflow-gpu
PyPI
 2.0.0 up to 2.0.3, plus listed versions
2.0.12.0.2
2.0.3
tensorflow-gpu
PyPI
 2.1.0 up to 2.1.2, plus listed versions
2.1.1
2.1.2
tensorflow-gpu
PyPI
 2.2.0 up to 2.2.1
2.2.1
tensorflow-gpu
PyPI
 2.3.0 up to 2.3.1
2.3.1
tensorflow
PyPI
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions
0.12.0rc00.12.0rc10.12.00.12.11.0.0
Show 45 moreShow less
1.0.11.1.0rc01.1.0rc11.1.0rc21.1.01.2.0rc01.2.0rc11.2.0rc21.2.01.2.11.3.0rc01.3.0rc11.3.0rc21.3.01.4.0rc01.4.0rc11.4.01.4.11.5.0rc01.5.0rc11.5.01.5.11.6.0rc01.6.0rc11.6.01.7.0rc01.7.0rc11.7.01.7.11.8.0rc01.8.0rc11.8.01.9.0rc01.9.0rc11.9.0rc21.9.01.10.0rc01.10.0rc11.10.01.10.11.11.0rc01.11.0rc11.11.0rc21.11.01.12.0rc0
1.15.42.0.32.1.22.2.12.3.1
tensorflow-cpu
PyPI
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions
1.15.02.1.1
1.15.42.0.32.1.22.2.12.3.1
tensorflow-gpu
PyPI
 before 1.15.4, 2.0.0 up to 2.0.3, 2.1.0 up to 2.1.2, 2.2.0 up to 2.2.1, 2.3.0 up to 2.3.1, plus listed versions
0.12.00.12.11.0.01.0.11.1.0
Show 27 moreShow less
1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.12.0.22.1.1
1.15.42.0.32.1.22.2.12.3.1
tensorflow2
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1
tensorflow2-lite
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1
tensorflow2_2_1_2-gnu-hpc
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1
tensorflow2_2_1_2-gnu-openmpi2-hpc
openSUSE:Leap 15.2
From an advisory covering 16 CVEs
 before 2.1.2-lp152.7.3.1
2.1.2-lp152.7.3.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-15209 is a medium vulnerability (CVSS 5.9) in Google Tensorflow, published September 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in tensorflow 1.15.4.

References

Show 177 moreShow less
This page doesn't list everything

Left out here: 23 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open