CVE-2020-26267: 
Python vulnerability analysis and mitigation

In affected versions of TensorFlow, the tf.raw_ops.DataFormatVecPermute API contained a vulnerability (CVE-2020-26267) where it failed to validate the src_format and dst_format attributes. The vulnerability affected TensorFlow versions prior to 2.4.0 and was patched in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0 (GitHub Advisory).

The vulnerability stems from the code's assumption that the src_format and dst_format arguments define a permutation of NHWC without proper validation. This lack of validation could lead to uninitialized memory accesses, out-of-bounds reads, and potential system crashes. The issue was classified with CWE-125 (Out-of-bounds Read) (NVD CNA Status).

When exploited, this vulnerability could result in uninitialized memory accesses, reads outside of bounds, and system crashes. The vulnerability affected both the tf.raw_ops.DataFormatVecPermute and tf.raw_ops.DataFormatDimMap APIs (GitHub Advisory).

The vulnerability could be triggered through the manipulation of src_format and dst_format attributes in the DataFormatVecPermute and DataFormatDimMap APIs. Examples of triggering inputs include using invalid format strings, mismatched lengths, and improper permutations (GitHub Advisory).

The vulnerability was patched in GitHub commit ebc70b7a592420d3d2f359e4b1694c236b82c7ae and released in TensorFlow versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. Users should upgrade to these patched versions to resolve the vulnerability (GitHub Advisory).

The vulnerability was reported by members of the Aivul Team from Qihoo 360 and was assigned a Low severity rating (GitHub Advisory).