CVE-2020-26268 (CNNVD-202012-828)
中文标题:
Google TensorFlow 安全漏洞
英文标题:
Write to immutable memory region in TensorFlow
漏洞描述
中文描述:
Google TensorFlow是美国谷歌（Google）公司的一套用于机器学习的端到端开源平台。 TensorFlow存在安全漏洞，攻击者可利用该漏洞导致缓冲区溢出。以下产品及版本受到影响：1.15.5、2.0.4、2.1.3、2.2.2、2.3.2、2.4.0。
英文描述:
In affected versions of TensorFlow the tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area. If the file is too small, TensorFlow properly returns an error as the memory area has fewer bytes than what is needed for the tensor it creates. However, as soon as there are enough bytes, the above snippet causes a segmentation fault. This is because the allocator used to return the buffer data is not marked as returning an opaque handle since the needed virtual method is not overridden. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| tensorflow | tensorflow | < 1.15.5 | - | - |
cpe:2.3:a:tensorflow:tensorflow:<_1.15.5:*:*:*:*:*:*:*
|
| tensorflow | tensorflow | >= 2.0.0, < 2.0.4 | - | - |
cpe:2.3:a:tensorflow:tensorflow:>=_2.0.0,_<_2.0.4:*:*:*:*:*:*:*
|
| tensorflow | tensorflow | >= 2.1.0, < 2.1.3 | - | - |
cpe:2.3:a:tensorflow:tensorflow:>=_2.1.0,_<_2.1.3:*:*:*:*:*:*:*
|
| tensorflow | tensorflow | >= 2.2.0, < 2.2.2 | - | - |
cpe:2.3:a:tensorflow:tensorflow:>=_2.2.0,_<_2.2.2:*:*:*:*:*:*:*
|
| tensorflow | tensorflow | >= 2.3.0, < 2.3.2 | - | - |
cpe:2.3:a:tensorflow:tensorflow:>=_2.3.0,_<_2.3.2:*:*:*:*:*:*:*
|
| tensorflow | * | - | - |
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2020-26268 |
2025-11-11 15:20:31 | 2025-11-11 07:36:14 |
| NVD | nvd_CVE-2020-26268 |
2025-11-11 14:57:06 | 2025-11-11 07:44:39 |
| CNNVD | cnnvd_CNNVD-202012-828 |
2025-11-11 15:10:32 | 2025-11-11 07:56:33 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202012-828
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 5 -> 6
- data_sources: ['cve'] -> ['cve', 'nvd']