QID 980167
QID 980167: Python (pip) Security Update for tensorflow-gpu (GHSA-j86v-p27c-73fm)
Security update has been released for tensorflow-gpu,tensorflow,tensorflow-cpu to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
During execution, [`EinsumHelper::ParseEquation()`](https://github.com/tensorflow/tensorflow/blob/e0b6e58c328059829c3eb968136f17aa72b6c876/tensorflow/core/kernels/linalg/einsum_op_impl.h#L126-L181) is supposed to set the flags in `input_has_ellipsis` vector and `*output_has_ellipsis` boolean to indicate whether there is ellipsis in the corresponding inputs and output.
However, the code only changes these flags to `true` and never assigns `false`.
```cc
for (int i = 0; i < num_inputs; ++i) {
input_label_counts->at(i).resize(num_labels);
for (const int label : input_labels->at(i)) {
if (label != kEllipsisLabel)
input_label_counts->at(i)[label] += 1;
else
input_has_ellipsis->at(i) = true;
}
}
output_label_counts->resize(num_labels);
for (const int label : *output_labels) {
if (label != kEllipsisLabel)
output_label_counts->at(label) += 1;
else
*output_has_ellipsis = true;
}
```
This results in unitialized variable access if callers assume that `EinsumHelper::ParseEquation()` always sets these flags.
The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- GHSA-j86v-p27c-73fm -
github.com/advisories/GHSA-j86v-p27c-73fm
CVEs related to QID 980167
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-j86v-p27c-73fm | tensorflow |
|
|
| GHSA-j86v-p27c-73fm | tensorflow-cpu |
|
|
| GHSA-j86v-p27c-73fm | tensorflow-gpu |
|