QID 982509
QID 982509: Python (pip) Security Update for tensorflow-gpu (GHSA-g4h2-gqm3-c9wq)
Security update has been released for tensorflow,tensorflow-cpu,tensorflow-gpu to fix the vulnerability.
Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.
Calling [`tf.raw_ops.ImmutableConst`](https://www.tensorflow.org/api_docs/python/tf/raw_ops/ImmutableConst) with a `dtype` of `tf.resource` or `tf.variant` results in a segfault in the implementation as code assumes that the tensor contents are pure scalars.
```python
>>> import tensorflow as tf
>>> tf.raw_ops.ImmutableConst(dtype=tf.resource, shape=[], memory_region_name="/tmp/test.txt")
...
Segmentation fault
```
Solution
We have patched the issue in 4f663d4b8f0bec1b48da6fa091a7d29609980fa4 and will release TensorFlow 2.5.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.Workaround:
If using `tf.raw_ops.ImmutableConst` in code, you can prevent the segfault by inserting a filter for the `dtype` argument.
If using `tf.raw_ops.ImmutableConst` in code, you can prevent the segfault by inserting a filter for the `dtype` argument.
Vendor References
- GHSA-g4h2-gqm3-c9wq -
github.com/advisories/GHSA-g4h2-gqm3-c9wq
CVEs related to QID 982509
Software Advisories
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| GHSA-g4h2-gqm3-c9wq | tensorflow |
|
|
| GHSA-g4h2-gqm3-c9wq | tensorflow-cpu |
|
|
| GHSA-g4h2-gqm3-c9wq | tensorflow-gpu |
|