1.2 KiB
TFSA-2019-002: Heap buffer overflow in UnsortedSegmentSum
CVE Number
CVE-2019-16778
Issue Description
A heap buffer overflow in UnsortedSegmentSum can be produced when the Index
template argument is int32. In this case data_size and num_segments fields
are truncated from int64 to int32 and can produce negative numbers,
resulting in accessing out of bounds heap memory.
Impact
This is unlikely to be exploitable and was detected and fixed internally. We are making the security advisory only to notify users that it is better to update to TensorFlow 1.15 or 2.0 or later as these versions already have this fixed.
Vulnerable Versions
TensorFlow 1.0.0, 1.0.1, 1.1.0, 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.5.0, 1.5.1, 1.6.0, 1.7.0, 1.7.1, 1.8.0, 1.9.0, 1.10.0, 1.10.1, 1.11.0, 1.12.0, 1.12.1, 1.12.2, 1.12.3, 1.13.0, 1.13.1, 1.13.2, 1.14.0.
Mitigation
We have patched the vulnerability in GitHub commit db4f971.
We encourage users to switch to TensorFlow 1.15 or 2.0 as these versions contain the fix. If switching is undesirable, consider cherry-picking the above commit and building from source.