CVE-2020-26268: 
Python vulnerability analysis and mitigation

The CVE-2020-26268 vulnerability affects TensorFlow's tf.raw_ops.ImmutableConst operation, which was discovered and disclosed on December 10, 2020. The vulnerability impacts multiple versions of TensorFlow before versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. The issue occurs when the operation attempts to handle non-integral type tensors from memory-mapped files (NVD).

The vulnerability stems from the tf.raw_ops.ImmutableConst operation's handling of constant tensors created from memory-mapped files. When processing non-integral type tensors, the operation attempts to write to memory areas that are supposed to be immutable. This occurs because the allocator used to return the buffer data is not marked as returning an opaque handle, as the required virtual method is not overridden. The vulnerability has been assigned a CVSS v3.1 score of 4.4 (MEDIUM) (NVD, GitHub Advisory).

When exploited, this vulnerability causes the Python interpreter to crash with a segmentation fault when attempting to process non-integral type tensors. The crash occurs specifically when there are sufficient bytes in the memory-mapped file for the tensor creation (GitHub Advisory).

The vulnerability can be triggered by creating an ImmutableConst operation with a non-integral tensor type (such as string) pointing to a memory-mapped file with sufficient bytes. While the system properly handles cases where the file is too small, it crashes when the file contains enough bytes for tensor creation (GitHub Advisory).

The vulnerability has been patched in TensorFlow versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. The fix involves marking the MemmappedTensorAllocator as returning an opaque handle to prevent writing to immutable memory regions. Users are advised to upgrade to these patched versions (GitHub Advisory).