Star0
8
代码
代码
Issues212
Pull Requests33
项目讨论
Wiki
分析
Star0
8
已开启
Fix CVE-2022-35985 #128
XingSongSun创建于 6月2日
Fix CVE-2022-35985 #128
已开启
XingSongSun创建于 6月2日
从XingSongSun/tensorflowCVE-2022-35985合入到src-openeuler/tensorflowopenEuler-24.03-LTS-SP3
共 2 个文件变更+91-2
Abackport-CVE-2022-35985.patch+85-0
@@ -0,0 +1,85 @@
1+From bd90b3efab4ec958b228cd7cfe9125be1c0cf255 Mon Sep 17 00:00:00 2001
2+From: Sagun Bajra <sagunb@google.com>
3+Date: Wed, 13 Jul 2022 09:46:48 -0700
4+Subject: [PATCH] Fix security vulnerability with LRNGradOp
5+ 
6+PiperOrigin-RevId: 460738938
7+---
8+ tensorflow/core/kernels/lrn_op.cc | 3 +-
9+ .../python/kernel_tests/nn_ops/lrn_op_test.py | 37 +++++++++++++++++++
10+ 2 files changed, 39 insertions(+), 1 deletion(-)
11+ 
12+diff --git a/tensorflow/core/kernels/lrn_op.cc b/tensorflow/core/kernels/lrn_op.cc
13+index 31aaf018329b52..0d6d24d3dce2df 100644
14+--- a/tensorflow/core/kernels/lrn_op.cc
15++++ b/tensorflow/core/kernels/lrn_op.cc
16+@@ -668,7 +668,8 @@ class LRNGradOp : public OpKernel {
17+ in_image.dim_size(0) == batch && in_image.dim_size(1) == rows &&
18+ in_image.dim_size(2) == cols && in_image.dim_size(3) == depth &&
19+ out_image.dim_size(0) == batch && out_image.dim_size(1) == rows &&
20+- out_image.dim_size(2) == cols && out_image.dim_size(3) == depth,
21++ out_image.dim_size(2) == cols && out_image.dim_size(3) == depth &&
22++ out_image.dims() == 4,
23+ errors::InvalidArgument(
24+ "input_grads, input_image, and out_image should have the same "
25+ "shape"));
26+diff --git a/tensorflow/python/kernel_tests/nn_ops/lrn_op_test.py b/tensorflow/python/kernel_tests/nn_ops/lrn_op_test.py
27+index 9fb7724f695375..f44c7316845b21 100644
28+--- a/tensorflow/python/kernel_tests/nn_ops/lrn_op_test.py
29++++ b/tensorflow/python/kernel_tests/nn_ops/lrn_op_test.py
30+@@ -20,11 +20,13 @@
31+
32+ from tensorflow.python.framework import constant_op
33+ from tensorflow.python.framework import dtypes
34++from tensorflow.python.framework import errors_impl
35+ from tensorflow.python.framework import test_util
36+ from tensorflow.python.ops import array_ops
37+ from tensorflow.python.ops import gradient_checker
38+ from tensorflow.python.ops import gradients_impl
39+ from tensorflow.python.ops import nn
40++from tensorflow.python.ops import random_ops
41+ import tensorflow.python.ops.nn_grad # pylint: disable=unused-import
42+ from tensorflow.python.platform import test
43+
44+@@ -111,6 +113,41 @@ def testGradientsZeroInput(self):
45+ self.assertAllClose(r, expected)
46+ self.assertShapeEqual(expected, grad)
47+
48++ @test_util.run_in_graph_and_eager_modes
49++ def testIncompatibleInputAndOutputImageShapes(self):
50++ depth_radius = 1
51++ bias = 1.59018219
52++ alpha = 0.117728651
53++ beta = 0.404427052
54++ input_grads = random_ops.random_uniform(
55++ shape=[4, 4, 4, 4],
56++ minval=-10000,
57++ maxval=10000,
58++ dtype=dtypes.float32,
59++ seed=-2033)
60++ input_image = random_ops.random_uniform(
61++ shape=[4, 4, 4, 4],
62++ minval=-10000,
63++ maxval=10000,
64++ dtype=dtypes.float32,
65++ seed=-2033)
66++ invalid_output_image = random_ops.random_uniform(
67++ shape=[4, 4, 4, 4, 4, 4],
68++ minval=-10000,
69++ maxval=10000,
70++ dtype=dtypes.float32,
71++ seed=-2033)
72++ with self.assertRaises((ValueError, errors_impl.InvalidArgumentError)):
73++ self.evaluate(
74++ nn.lrn_grad(
75++ input_grads=input_grads,
76++ input_image=input_image,
77++ output_image=invalid_output_image,
78++ depth_radius=depth_radius,
79++ bias=bias,
80++ alpha=alpha,
81++ beta=beta))
82++
83+ def _RunAndVerifyGradients(self, dtype):
84+ with self.cached_session():
85+ # random shape
Mtensorflow.spec+6-2
@@ -1,7 +1,7 @@
1%global _empty_manifest_terminate_build 01%global _empty_manifest_terminate_build 0
2Name: tensorflow2Name: tensorflow
3Version: 2.12.13Version: 2.12.1
4-Release: 54+Release: 6
5Summary: An Open Source Machine Learning Framework for Everyone5Summary: An Open Source Machine Learning Framework for Everyone
6License: Apache License 2.06License: Apache License 2.0
7URL: https://www.tensorflow.org/7URL: https://www.tensorflow.org/
@@ -17,6 +17,7 @@ Patch1000: aarch64_external_files.patch
17%endif17%endif
18%ifarch riscv6418%ifarch riscv64
19Patch1100: riscv64_external_files.patch19Patch1100: riscv64_external_files.patch
20+Patch1101: backport-CVE-2022-35985.patch
20%endif21%endif
21Requires: python3-future python3-numpy python3-six python3-astunparse python3-google-pasta python3-opt-einsum22Requires: python3-future python3-numpy python3-six python3-astunparse python3-google-pasta python3-opt-einsum
22Requires: python3-typing-extensions python3-wrapt python3-h5py python3-protobuf python3-grpcio python3-absl-py 23Requires: python3-typing-extensions python3-wrapt python3-h5py python3-protobuf python3-grpcio python3-absl-py
@@ -45,6 +46,7 @@ TensorFlow provides stable Python and C++ APIs, as well as non-guaranteed backwa
45 46 
46%prep47%prep
47%setup -n %{name}-%{version}48%setup -n %{name}-%{version}
49+%patch -P 1101 -p1
48%patch 0 -p150%patch 0 -p1
49%patch 1 -p151%patch 1 -p1
50%patch 2 -p152%patch 2 -p1
@@ -84,6 +86,8 @@ bazel --output_user_root=`pwd`/../output_user_root build --nofetch --host_copt=-
84%{_bindir}/*86%{_bindir}/*
85 87 
86%changelog88%changelog
89+* Tue Jun 02 2026 sunwenhan <sunwenhan@xfusion.com> - 2.12.1-6
90+- Fix CVE-2022-35985
87* Tue Mar 03 2026 megranate wangkunjie@xfuison.com - 2.12.1-591* Tue Mar 03 2026 megranate wangkunjie@xfuison.com - 2.12.1-5
88- fix CVE-2026-249292- fix CVE-2026-2492
89 93 
@@ -122,4 +126,4 @@ bazel --output_user_root=`pwd`/../output_user_root build --nofetch --host_copt=-
122- fix some cves126- fix some cves
123 127 
124* Wed Sep 30 2020 Zhipeng Xie<xiezhipeng1@huawei.com> - 2.3.1-1128* Wed Sep 30 2020 Zhipeng Xie<xiezhipeng1@huawei.com> - 2.3.1-1
125-- Package init129+- Package init