!33 fix CVE-2021-37690
From: @starlet-dx Reviewed-by: @yangzhao_kl Signed-off-by: @yangzhao_kl
This commit is contained in:
openeuler-ci-bot
Gitee
commit
6eba483a74
56
CVE-2021-37690-1.patch
Normal file
56
CVE-2021-37690-1.patch
Normal file
@ -0,0 +1,56 @@
|
||||
From ee119d4a498979525046fba1c3dd3f13a039fbb1 Mon Sep 17 00:00:00 2001
|
||||
From: Daniel Ellis <danielellis@google.com>
|
||||
Date: Wed, 14 Jul 2021 12:43:17 -0700
|
||||
Subject: [PATCH] Fix segmentation fault in shape inference logic.
|
||||
|
||||
When running shape functions, some functions (such as `MutableHashTableShape`)
|
||||
produce extra output information in the form of a `ShapeAndType` struct. The
|
||||
shapes embedded in this struct are owned by an inference context that is
|
||||
cleaned up almost immediately; if the upstream code attempts to access this
|
||||
shape information, it can trigger a segfault.
|
||||
|
||||
`ShapeRefiner` is mitigating this for normal output shapes by cloning them
|
||||
(and thus putting the newly created shape under ownership of an inference
|
||||
context that will not die), but we were not doing the same for shapes and
|
||||
types. This commit fixes that by doing similar logic on output shapes and
|
||||
types.
|
||||
|
||||
PiperOrigin-RevId: 384761124
|
||||
Change-Id: I07c0c42d29dfbb55bfa13ec1f09ef825fb0a1a1d
|
||||
---
|
||||
.../core/common_runtime/shape_refiner.cc | 21 +++++++++++++++++--
|
||||
1 file changed, 19 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/tensorflow/core/common_runtime/shape_refiner.cc b/tensorflow/core/common_runtime/shape_refiner.cc
|
||||
index 375f809b31b36..2e29ef48189a5 100644
|
||||
--- a/tensorflow/core/common_runtime/shape_refiner.cc
|
||||
+++ b/tensorflow/core/common_runtime/shape_refiner.cc
|
||||
@@ -120,9 +120,26 @@ Status ShapeRefiner::InferShapesForFunctionSubNode(
|
||||
TF_RETURN_IF_ERROR(outer_context->MakeShapeFromShapeProto(proto, &handle));
|
||||
outer_context->set_output(index, handle);
|
||||
|
||||
- auto* resource = node_context->input_handle_shapes_and_types(0);
|
||||
+ const std::vector<ShapeAndType>* resource =
|
||||
+ node_context->input_handle_shapes_and_types(0);
|
||||
if (resource) {
|
||||
- outer_context->set_output_handle_shapes_and_types(index, *resource);
|
||||
+ // `ShapesAndType`s contain `ShapeHandle`s. These `ShapeHandle`s point
|
||||
+ // to `Shape`s that are owned by a different inference context too. We
|
||||
+ // need to copy them to the outer context to prevent them from being
|
||||
+ // destroyed before they are used.
|
||||
+ std::vector<ShapeAndType> copied_shapes_and_types;
|
||||
+ for (auto& shape_and_type : *resource) {
|
||||
+ ShapeHandle handle;
|
||||
+ TensorShapeProto proto;
|
||||
+ node_context->ShapeHandleToProto(shape_and_type.shape, &proto);
|
||||
+ TF_RETURN_IF_ERROR(
|
||||
+ outer_context->MakeShapeFromShapeProto(proto, &handle));
|
||||
+ copied_shapes_and_types.push_back(
|
||||
+ ShapeAndType(handle, shape_and_type.dtype, shape_and_type.type));
|
||||
+ }
|
||||
+
|
||||
+ outer_context->set_output_handle_shapes_and_types(
|
||||
+ index, copied_shapes_and_types);
|
||||
}
|
||||
}
|
||||
|
||||
25
CVE-2021-37690-2.patch
Normal file
25
CVE-2021-37690-2.patch
Normal file
@ -0,0 +1,25 @@
|
||||
From d8e07ff51f9e709399b8c553290836fb308e45ed Mon Sep 17 00:00:00 2001
|
||||
From: geetachavan1 <53313357+geetachavan1@users.noreply.github.com>
|
||||
Date: Tue, 27 Jul 2021 16:08:12 -0700
|
||||
Subject: [PATCH 1/1] Update shape_refiner.cc
|
||||
|
||||
---
|
||||
tensorflow/core/common_runtime/shape_refiner.cc | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/tensorflow/core/common_runtime/shape_refiner.cc b/tensorflow/core/common_runtime/shape_refiner.cc
|
||||
index 6a7d1eadfb6..906bd14f96c 100644
|
||||
--- a/tensorflow/core/common_runtime/shape_refiner.cc
|
||||
+++ b/tensorflow/core/common_runtime/shape_refiner.cc
|
||||
@@ -132,7 +132,7 @@ Status InferShapesForFunctionSubNode(const Node* node, ShapeRefiner* refiner,
|
||||
TF_RETURN_IF_ERROR(
|
||||
outer_context->MakeShapeFromShapeProto(proto, &handle));
|
||||
copied_shapes_and_types.push_back(
|
||||
- ShapeAndType(handle, shape_and_type.dtype, shape_and_type.type));
|
||||
+ ShapeAndType(handle, shape_and_type.dtype, shape_and_type.specialized_type));
|
||||
}
|
||||
|
||||
outer_context->set_output_handle_shapes_and_types(
|
||||
--
|
||||
2.27.0
|
||||
|
||||
25
CVE-2021-37690-3.patch
Normal file
25
CVE-2021-37690-3.patch
Normal file
@ -0,0 +1,25 @@
|
||||
From 106316a9077cfabca5d54721650c9a65fef4dc6a Mon Sep 17 00:00:00 2001
|
||||
From: Mihai Maruseac <mihaimaruseac@google.com>
|
||||
Date: Sat, 7 Aug 2021 17:18:11 -0700
|
||||
Subject: [PATCH 1/1] Fix build
|
||||
|
||||
---
|
||||
tensorflow/core/common_runtime/shape_refiner.cc | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/tensorflow/core/common_runtime/shape_refiner.cc b/tensorflow/core/common_runtime/shape_refiner.cc
|
||||
index 906bd14f96c..3c5421a9507 100644
|
||||
--- a/tensorflow/core/common_runtime/shape_refiner.cc
|
||||
+++ b/tensorflow/core/common_runtime/shape_refiner.cc
|
||||
@@ -132,7 +132,7 @@ Status InferShapesForFunctionSubNode(const Node* node, ShapeRefiner* refiner,
|
||||
TF_RETURN_IF_ERROR(
|
||||
outer_context->MakeShapeFromShapeProto(proto, &handle));
|
||||
copied_shapes_and_types.push_back(
|
||||
- ShapeAndType(handle, shape_and_type.dtype, shape_and_type.specialized_type));
|
||||
+ ShapeAndType(handle, shape_and_type.dtype));
|
||||
}
|
||||
|
||||
outer_context->set_output_handle_shapes_and_types(
|
||||
--
|
||||
2.27.0
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
%global _empty_manifest_terminate_build 0
|
||||
Name: tensorflow
|
||||
Version: 2.3.1
|
||||
Release: 11
|
||||
Release: 12
|
||||
Summary: An Open Source Machine Learning Framework for Everyone
|
||||
License: Apache License 2.0
|
||||
URL: https://www.tensorflow.org/
|
||||
@ -185,6 +185,9 @@ Patch0173: CVE-2021-29516-2.patch
|
||||
Patch0174: CVE-2021-29516-3.patch
|
||||
Patch0175: CVE-2021-29516-4.patch
|
||||
Patch0176: CVE-2021-37679.patch
|
||||
Patch0177: CVE-2021-37690-1.patch
|
||||
Patch0178: CVE-2021-37690-2.patch
|
||||
Patch0179: CVE-2021-37690-3.patch
|
||||
Requires: python3-future
|
||||
Requires: python3-numpy
|
||||
|
||||
@ -231,6 +234,9 @@ bazel --output_user_root=`pwd`/../output_user_root build --host_copt=-Wno-string
|
||||
%{_bindir}/*
|
||||
|
||||
%changelog
|
||||
* Thu Sep 16 2021 yaoxin <yaoxin30@huawei.com> - 2.3.1-12
|
||||
- Fix CVE-2021-37690
|
||||
|
||||
* Mon Sep 13 2021 yaoxin <yaoxin30@huawei.com> - 2.3.1-11
|
||||
- Fix CVE-2021-29516 CVE-2021-37679
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user