CVE-2020-15202

Integer truncation in Shard API usage

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `Shard` API in TensorFlow expects the last argument to be a function taking two `int64` (i.e., `long long`) arguments. However, there are several places in TensorFlow where a lambda taking `int` or `int32` arguments is being used. In these cases, if the amount of work to be parallelized is large enough, integer truncation occurs. Depending on how the two arguments of the lambda are used, this can result in segfaults, read/write outside of heap allocated arrays, stack overflows, or data corruption. The issue is patched in commits 27b417360cbd671ef55915e4bb6bb06af8b8a832 and ca8c013b5e97b1373b3bb1c97ea655e69f31a575, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

We have discovered 51 live websites that are affected by CVE-2020-15202.

Run a Free Instant Scan



Affected Software

Product  tensorflow
Category JavaScript Libraries
Vulnerable Domains51 live websites (22% of tensorflow install base)
Vulnerable Versions
  • from 0 through 1.15.4
  • from 2 through 2.0.3
  • from 2.1 through 2.1.2
  • from 2.2 through 2.2.1
  • from 2.3 through 2.3.1
Vulnerable Versions Count6 versions ( 43% of all versions)


Common Weakness Enumeration

CWE-197 Numeric Truncation Error



Details

  • Published - Sep 26, 2020
  • Updated - Aug 4, 2024

Website Distribution by Country

Number of websites using CVE-2020-15202
United States36 websites


Germany4 websites
Canada2 websites
India2 websites
Austria1 websites
Brazil1 websites
Chile1 websites
Cyprus1 websites
Denmark1 websites
Korea, South1 websites

Website Distribution by TLD

Number of websites using CVE-2020-15202
.com21 websites
.org2 websites
.at1 websites
.ch1 websites
.com.br1 websites
.de1 websites
.dk1 websites
.io1 websites
.net1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2020-15202

Top websites that are affected by CVE-2020-15202. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
************.com United States***,***
*******.************.de Germany***,***
******.me United States*,***,***
***********.com United States*,***,***
************.com United States*,***,***
***********.com United States*,***,***
*******.**.kr Korea, South*,***,***
**********.com Netherlands*,***,***
******.com Canada*,***,***
*********.******.**********.org Germany*,***,***
See full domain list

FAQ

CVE-2020-15202 is Numeric Truncation Error in tensorflow
A total of 51 websites have been identified as vulnerable to CVE-2020-15202, based on global website indexing conducted by WebTechSurvey.
The tensorflow is affected by the CVE-2020-15202 vulnerability.
tensorflow versions up to 2.3.1 are vulnerable to CVE-2020-15202.
CVE-2020-15202 is resolved in version 2.3.1 of tensorflow.