已开启
Fix CVE-2022-23588 #135
XingSongSun创建于 6月2日
Fix CVE-2022-23588 #135
已开启
共 2 个文件变更+37-2
| @@ -0,0 +1,31 @@ | |||
| 1 | +From 6b5adc0877de832b2a7c189532dbbbc64622eeb6 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Mihai Maruseac <mihaimaruseac@google.com> | ||
| 3 | +Date: Sat, 13 Nov 2021 07:28:58 -0800 | ||
| 4 | +Subject: [PATCH] Prevent `CHECK`-fail when building reference tensor. | ||
| 5 | + | ||
| 6 | +The tensor constructor does not allow reference dtypes, as these should not show up explicitly. However, when passed these invalid types instead of building an invalid object the constructor crashes via a `CHECK`-fail. We have a static builder that properly handles this case but is not applicable given current usage. | ||
| 7 | + | ||
| 8 | +Instead, before calling the constructor, we can check that the dtype is not a reference type and return an error otherwise, given that the dtype is user controlled so malicious users can trigger denial of service. | ||
| 9 | + | ||
| 10 | +PiperOrigin-RevId: 409662503 | ||
| 11 | +Change-Id: I5892f831fde7f276cd7ab34519cf6b8061c71a59 | ||
| 12 | +--- | ||
| 13 | + tensorflow/core/grappler/optimizers/constant_folding.cc | 5 +++++ | ||
| 14 | + 1 file changed, 5 insertions(+) | ||
| 15 | + | ||
| 16 | +diff --git a/tensorflow/core/grappler/optimizers/constant_folding.cc b/tensorflow/core/grappler/optimizers/constant_folding.cc | ||
| 17 | +index d5fadb311a75cc..281806be20259f 100644 | ||
| 18 | +--- a/tensorflow/core/grappler/optimizers/constant_folding.cc | ||
| 19 | ++++ b/tensorflow/core/grappler/optimizers/constant_folding.cc | ||
| 20 | + Status ConstantFolding::EvaluateOneFoldable(const NodeDef& node, | ||
| 21 | + input_tensor.ToString(), | ||
| 22 | + " has a dtype of DT_INVALID.")); | ||
| 23 | + } | ||
| 24 | ++ if (IsRefType(raw_val.dtype())) { | ||
| 25 | ++ return errors::InvalidArgument( | ||
| 26 | ++ "Not allowed to construct a tensor with reference dtype, got ", | ||
| 27 | ++ DataTypeString(raw_val.dtype())); | ||
| 28 | ++ } | ||
| 29 | + Tensor* value = new Tensor(raw_val.dtype(), raw_val.tensor_shape()); | ||
| 30 | + if (!value->FromProto(raw_val)) { | ||
| 31 | + delete (value); | ||
| @@ -1,7 +1,7 @@ | |||
| 1 | %global _empty_manifest_terminate_build 0 | 1 | %global _empty_manifest_terminate_build 0 |
| 2 | Name: tensorflow | 2 | Name: tensorflow |
| 3 | Version: 2.12.1 | 3 | Version: 2.12.1 |
| 4 | -Release: 5 | 4 | +Release: 6 |
| 5 | Summary: An Open Source Machine Learning Framework for Everyone | 5 | Summary: An Open Source Machine Learning Framework for Everyone |
| 6 | License: Apache License 2.0 | 6 | License: Apache License 2.0 |
| 7 | URL: https://www.tensorflow.org/ | 7 | URL: https://www.tensorflow.org/ |
| @@ -17,6 +17,7 @@ Patch1000: aarch64_external_files.patch | |||
| 17 | %endif | 17 | %endif |
| 18 | %ifarch riscv64 | 18 | %ifarch riscv64 |
| 19 | Patch1100: riscv64_external_files.patch | 19 | Patch1100: riscv64_external_files.patch |
| 20 | +Patch1101: backport-CVE-2022-23588.patch | ||
| 20 | %endif | 21 | %endif |
| 21 | Requires: python3-future python3-numpy python3-six python3-astunparse python3-google-pasta python3-opt-einsum | 22 | Requires: python3-future python3-numpy python3-six python3-astunparse python3-google-pasta python3-opt-einsum |
| 22 | Requires: python3-typing-extensions python3-wrapt python3-h5py python3-protobuf python3-grpcio python3-absl-py | 23 | Requires: python3-typing-extensions python3-wrapt python3-h5py python3-protobuf python3-grpcio python3-absl-py |
| @@ -45,6 +46,7 @@ TensorFlow provides stable Python and C++ APIs, as well as non-guaranteed backwa | |||
| 45 | 46 | ||
| 46 | %prep | 47 | %prep |
| 47 | %setup -n %{name}-%{version} | 48 | %setup -n %{name}-%{version} |
| 49 | +%patch -P 1101 -p1 | ||
| 48 | %patch 0 -p1 | 50 | %patch 0 -p1 |
| 49 | %patch 1 -p1 | 51 | %patch 1 -p1 |
| 50 | %patch 2 -p1 | 52 | %patch 2 -p1 |
| @@ -84,6 +86,8 @@ bazel --output_user_root=`pwd`/../output_user_root build --nofetch --host_copt=- | |||
| 84 | %{_bindir}/* | 86 | %{_bindir}/* |
| 85 | 87 | ||
| 86 | %changelog | 88 | %changelog |
| 89 | +* Tue Jun 02 2026 sunwenhan <sunwenhan@xfusion.com> - 2.12.1-6 | ||
| 90 | +- Fix CVE-2022-23588 | ||
| 87 | * Tue Mar 03 2026 megranate wangkunjie@xfuison.com - 2.12.1-5 | 91 | * Tue Mar 03 2026 megranate wangkunjie@xfuison.com - 2.12.1-5 |
| 88 | - fix CVE-2026-2492 | 92 | - fix CVE-2026-2492 |
| 89 | 93 | ||
| @@ -122,4 +126,4 @@ bazel --output_user_root=`pwd`/../output_user_root build --nofetch --host_copt=- | |||
| 122 | - fix some cves | 126 | - fix some cves |
| 123 | 127 | ||
| 124 | * Wed Sep 30 2020 Zhipeng Xie<xiezhipeng1@huawei.com> - 2.3.1-1 | 128 | * Wed Sep 30 2020 Zhipeng Xie<xiezhipeng1@huawei.com> - 2.3.1-1 |
| 125 | -- Package init | 129 | +- Package init |