CVE-2020-15205: Improper Restriction of Operations within the Bounds of a Memory Buffer
(updated )
In Tensorflow, the data_splits
argument of tf.raw_ops.StringNGrams
lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after ee ff
are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR.
References
Detect and mitigate CVE-2020-15205 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →