QID 982468
QID 982468: Python (pip) Security Update for tensorflow (GHSA-mv78-g7wq-mhp4)
Security update has been released for tensorflow to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
The TFLite computation for size of output after padding, [`ComputeOutSize`](https://github.com/tensorflow/tensorflow/blob/0c9692ae7b1671c983569e5d3de5565843d500cf/tensorflow/lite/kernels/padding.h#L43-L55), does not check that the `stride` argument is not 0 before doing the division.
```cc
inline int ComputeOutSize(TfLitePadding padding, int image_size,
int filter_size, int stride, int dilation_rate = 1) {
int effective_filter_size = (filter_size - 1) * dilation_rate + 1;
switch (padding) {
case kTfLitePaddingSame:
return (image_size + stride - 1) / stride;
case kTfLitePaddingValid:
return (image_size + stride - effective_filter_size) / stride;
default:
return 0;
}
}
```
Users can craft special models such that `ComputeOutSize` is called with `stride` set to 0.
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
- GHSA-mv78-g7wq-mhp4 -
github.com/advisories/GHSA-mv78-g7wq-mhp4
CVEs related to QID 982468
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-mv78-g7wq-mhp4 | tensorflow |
|