QID 982479
QID 982479: Python (pip) Security Update for tensorflow-gpu (GHSA-545v-42p7-98fq)
Security update has been released for tensorflow,tensorflow-cpu,tensorflow-gpu to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs:
```python
import tensorflow as tf
input = tf.constant([10.0, 10.0, 10.0], shape=[1, 1, 3, 1], dtype=tf.float32)
grad = tf.constant([10.0, 10.0, 10.0, 10.0], shape=[1, 1, 1, 4], dtype=tf.float32)
argmax = tf.constant([1], shape=[1], dtype=tf.int64)
ksize = [1, 1, 1, 1]
strides = [1, 1, 1, 1]
tf.raw_ops.MaxPoolGradWithArgmax(
input=input, grad=grad, argmax=argmax, ksize=ksize, strides=strides,
padding='SAME', include_batch_in_index=False)
```
The [implementation](https://github.com/tensorflow/tensorflow/blob/ef0c008ee84bad91ec6725ddc42091e19a30cf0e/tensorflow/core/kernels/maxpooling_op.cc#L1016-L1017) uses the same value to index in two different arrays but there is no guarantee that the sizes are identical.
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
- GHSA-545v-42p7-98fq -
github.com/advisories/GHSA-545v-42p7-98fq
CVEs related to QID 982479
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-545v-42p7-98fq | tensorflow |
|
|
| GHSA-545v-42p7-98fq | tensorflow-cpu |
|
|
| GHSA-545v-42p7-98fq | tensorflow-gpu |
|