CVE-2020-15202 (C++, published 2020-09-25T19:15Z)
Description: value: In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `Shard` API in TensorFlow expects the last argument to be a function taking two `int64` (i.e., `long long`) arguments. However, there are several places in TensorFlow where a lambda taking `int` or `int32` arguments is being used. In these cases, if the amount of work to be parallelized is large enough, integer truncation occurs. Depending on how the two arguments of the lambda are used, this can result in segfaults, read/write outside of heap allocated arrays, stack overflows, or data corruption. The issue is patched in commits 27b417360cbd671ef55915e4bb6bb06af8b8a832 and ca8c013b5e97b1373b3bb1c97ea655e69f31a575, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Severity: MEDIUM (CVSS v3 base score: 9)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/boosted_trees/prediction_ops.cc
tensorflow/core/kernels/image/crop_and_resize_op.cc
tensorflow/core/kernels/linalg/banded_triangular_solve_op.cc
tensorflow/core/kernels/nth_element_op.cc
tensorflow/core/kernels/parameterized_truncated_normal_op.cc
tensorflow/core/kernels/random_binomial_op.cc
tensorflow/core/kernels/random_poisson_op.cc
tensorflow/core/kernels/stateless_random_ops.cc
tensorflow/core/kernels/topk_op.cc
Commit message: Prevent integer truncation from 64 to 32 bits.

The `tensorflow::Shard` functions last argument must be a 2 argument function where both arguments are `int64` (`long long`, 64 bits). However, there are usages where code passes in a function where arguments are `int` or `int32` (32 bits). In these cases, it is possible that the integer truncation would later cause a segfault or other unexpected behavior.

PiperOrigin-RevId: 332560414
Change-Id: Ief649406babc8d4f60b3e7a9d573cbcc5ce5b767


Vulnerable code:
                      this](int32 start, int32 end) {
                    this](int32 start, int32 end) {
                    last_tree](int32 start, int32 end) {
    auto CropAndResizePerBox = [&](int start_box, int limit_box) {
    auto CropAndResizeBackImgPerBox = [&](int start_box, int limit_box) {
          [&in_x, &in_y, adjoint, lower, &bcast, out](int start, int limit) {
    auto SubNthElement = [&, input, output, last_dim, n](int start, int limit) {
                    kStdDevsInsideBoundsToUseRandnSampler](int start_batch,
                                                           int limit_batch) {
                    kStdDevsInsideBoundsToUseRandnSampler](int start_output,
                                                           int limit_output) {
                   &gen, &output](int start_output, int limit_output) {
                      int start_output, int limit_output) {
                   alpha_flat](int start_output, int limit_output) {
    auto SortIndices = [&](int start_batch, int limit_batch) {

Fixed code:
                      this](int64 start, int64 end) {
                    this](int64 start, int64 end) {
                    last_tree](int64 start, int64 end) {
    auto CropAndResizePerBox = [&](int64 start_box, int64 limit_box) {
    auto CropAndResizeBackImgPerBox = [&](int64 start_box, int64 limit_box) {
          [&in_x, &in_y, adjoint, lower, &bcast, out](int64 start,
                                                      int64 limit) {
    auto SubNthElement = [&, input, output, last_dim, n](int64 start,
                                                         int64 limit) {
                    kStdDevsInsideBoundsToUseRandnSampler](int64 start_batch,
                                                           int64 limit_batch) {
                    kStdDevsInsideBoundsToUseRandnSampler](int64 start_output,
                                                           int64 limit_output) {
                   &gen, &output](int64 start_output, int64 limit_output) {
                      int64 start_output, int64 limit_output) {
                   alpha_flat](int64 start_output, int64 limit_output) {
    auto SortIndices = [&](int64 start_batch, int64 limit_batch) {