QID 981512
QID 981512: Python (pip) Security Update for tensorflow-gpu (GHSA-fcwc-p4fc-c5cc)
Security update has been released for tensorflow-gpu,tensorflow,tensorflow-cpu to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
If a user does not provide a valid padding value to `tf.raw_ops.MatrixDiagPartOp`, then the code triggers a null pointer dereference (if input is empty) or produces invalid behavior, ignoring all values after the first:
```python
import tensorflow as tf
tf.raw_ops.MatrixDiagPartV2(
input=tf.ones(2,dtype=tf.int32),
k=tf.ones(2,dtype=tf.int32),
padding_value=[])
```
Although this example is given for `MatrixDiagPartV2`, all versions of the operation are affected.
The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/linalg/matrix_diag_op.cc#L89) reads the first value from a tensor buffer without first checking that the tensor has values to read from.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- GHSA-fcwc-p4fc-c5cc -
github.com/advisories/GHSA-fcwc-p4fc-c5cc
CVEs related to QID 981512
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-fcwc-p4fc-c5cc | tensorflow |
|
|
| GHSA-fcwc-p4fc-c5cc | tensorflow-cpu |
|
|
| GHSA-fcwc-p4fc-c5cc | tensorflow-gpu |
|