CVE-2020-15204 — MEDIUM (CVSS 5.3) AI Security Vulnerability

CISO Take

Network-accessible TensorFlow instances running in eager mode can be crashed by any unauthenticated attacker by invoking GetSessionHandle ops, causing a denial-of-service. Patch to TF 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1 immediately. If patching is delayed, restrict network access to TensorFlow Serving endpoints and block raw op exposure at the API gateway level.

Risk Assessment

Medium risk (CVSS 5.3). The attack is trivially exploitable—no authentication, no user interaction, low complexity over the network—but impact is limited to partial availability loss. Not in CISA KEV and no evidence of active exploitation. Primary concern is operational disruption to ML inference services rather than data breach or system compromise. Deployments with internet-facing TF Serving instances carry the highest operational risk.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
tensorflow	pip	—	No patch
195.0K OpenSSF 7.2 3.7K dependents Pushed 6d ago 4% patched ~1372d to patch Full package profile →
leap	—	—	No patch

Severity & Risk

CVSS 3.1

5.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A Low

Recommended Action

4 steps

Patch: Upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Workaround: Restrict network access to TensorFlow Serving endpoints via firewall; block access to raw ops endpoints if not operationally required.
Detection: Monitor for unexpected process crashes or segmentation faults in TF serving and inference logs—repeated crashes from the same source IP are a strong indicator.
Audit: Inventory all TF deployments and their network exposure, prioritizing internet-facing instances for immediate patching.

Classification

DoS Framework Inference AML.T0010.001 - AI Software AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Compliance Impact

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

8.4 - AI System Operation

NIST AI RMF

MANAGE-2.2 - Mechanisms to Manage AI Risks

Frequently Asked Questions

What is CVE-2020-15204?

Network-accessible TensorFlow instances running in eager mode can be crashed by any unauthenticated attacker by invoking GetSessionHandle ops, causing a denial-of-service. Patch to TF 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1 immediately. If patching is delayed, restrict network access to TensorFlow Serving endpoints and block raw op exposure at the API gateway level.

Is CVE-2020-15204 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2020-15204, increasing the risk of exploitation.

How to fix CVE-2020-15204?

1. Patch: Upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. 2. Workaround: Restrict network access to TensorFlow Serving endpoints via firewall; block access to raw ops endpoints if not operationally required. 3. Detection: Monitor for unexpected process crashes or segmentation faults in TF serving and inference logs—repeated crashes from the same source IP are a strong indicator. 4. Audit: Inventory all TF deployments and their network exposure, prioritizing internet-facing instances for immediate patching.

What systems are affected by CVE-2020-15204?

This vulnerability affects the following AI/ML architecture patterns: model serving, inference, training pipelines.

What is the CVSS score for CVE-2020-15204?

CVE-2020-15204 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.22%.

Technical Details

NVD Description

In eager mode, TensorFlow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1 does not set the session state. Hence, calling `tf.raw_ops.GetSessionHandle` or `tf.raw_ops.GetSessionHandleV2` results in a null pointer dereference In linked snippet, in eager mode, `ctx->session_state()` returns `nullptr`. Since code immediately dereferences this, we get a segmentation fault. The issue is patched in commit 9a133d73ae4b4664d22bd1aa6d654fec13c52ee1, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Exploitation Scenario

An attacker discovers a TensorFlow Serving or custom TF inference API endpoint exposed over the internet. Without any credentials, they craft a request that invokes tf.raw_ops.GetSessionHandle (or GetSessionHandleV2) while the runtime is in eager mode. Since eager mode does not initialize session state, ctx->session_state() returns nullptr; the immediate dereference causes a segmentation fault, crashing the TensorFlow process and taking down the inference service. Any ML-dependent application relying on that endpoint is disrupted until ops staff manually restart the service—enabling repeated, low-effort availability attacks.