From 912aea0f079b0cfa1ee199cc8a217c75b08b0d51 Mon Sep 17 00:00:00 2001 From: starlet-dx <15929766099@163.com> Date: Thu, 16 Sep 2021 14:29:04 +0800 Subject: [PATCH] fix CVE-2021-37690 --- CVE-2021-37690-1.patch | 56 ++++++++++++++++++++++++++++++++++++++++++ CVE-2021-37690-2.patch | 25 +++++++++++++++++++ CVE-2021-37690-3.patch | 25 +++++++++++++++++++ tensorflow.spec | 8 +++++- 4 files changed, 113 insertions(+), 1 deletion(-) create mode 100644 CVE-2021-37690-1.patch create mode 100644 CVE-2021-37690-2.patch create mode 100644 CVE-2021-37690-3.patch diff --git a/CVE-2021-37690-1.patch b/CVE-2021-37690-1.patch new file mode 100644 index 0000000..812ad9b --- /dev/null +++ b/CVE-2021-37690-1.patch @@ -0,0 +1,56 @@ +From ee119d4a498979525046fba1c3dd3f13a039fbb1 Mon Sep 17 00:00:00 2001 +From: Daniel Ellis +Date: Wed, 14 Jul 2021 12:43:17 -0700 +Subject: [PATCH] Fix segmentation fault in shape inference logic. + +When running shape functions, some functions (such as `MutableHashTableShape`) +produce extra output information in the form of a `ShapeAndType` struct. The +shapes embedded in this struct are owned by an inference context that is +cleaned up almost immediately; if the upstream code attempts to access this +shape information, it can trigger a segfault. + +`ShapeRefiner` is mitigating this for normal output shapes by cloning them +(and thus putting the newly created shape under ownership of an inference +context that will not die), but we were not doing the same for shapes and +types. This commit fixes that by doing similar logic on output shapes and +types. + +PiperOrigin-RevId: 384761124 +Change-Id: I07c0c42d29dfbb55bfa13ec1f09ef825fb0a1a1d +--- + .../core/common_runtime/shape_refiner.cc | 21 +++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +diff --git a/tensorflow/core/common_runtime/shape_refiner.cc b/tensorflow/core/common_runtime/shape_refiner.cc +index 375f809b31b36..2e29ef48189a5 100644 +--- a/tensorflow/core/common_runtime/shape_refiner.cc ++++ b/tensorflow/core/common_runtime/shape_refiner.cc +@@ -120,9 +120,26 @@ Status ShapeRefiner::InferShapesForFunctionSubNode( + TF_RETURN_IF_ERROR(outer_context->MakeShapeFromShapeProto(proto, &handle)); + outer_context->set_output(index, handle); + +- auto* resource = node_context->input_handle_shapes_and_types(0); ++ const std::vector* resource = ++ node_context->input_handle_shapes_and_types(0); + if (resource) { +- outer_context->set_output_handle_shapes_and_types(index, *resource); ++ // `ShapesAndType`s contain `ShapeHandle`s. These `ShapeHandle`s point ++ // to `Shape`s that are owned by a different inference context too. We ++ // need to copy them to the outer context to prevent them from being ++ // destroyed before they are used. ++ std::vector copied_shapes_and_types; ++ for (auto& shape_and_type : *resource) { ++ ShapeHandle handle; ++ TensorShapeProto proto; ++ node_context->ShapeHandleToProto(shape_and_type.shape, &proto); ++ TF_RETURN_IF_ERROR( ++ outer_context->MakeShapeFromShapeProto(proto, &handle)); ++ copied_shapes_and_types.push_back( ++ ShapeAndType(handle, shape_and_type.dtype, shape_and_type.type)); ++ } ++ ++ outer_context->set_output_handle_shapes_and_types( ++ index, copied_shapes_and_types); + } + } + diff --git a/CVE-2021-37690-2.patch b/CVE-2021-37690-2.patch new file mode 100644 index 0000000..666ed58 --- /dev/null +++ b/CVE-2021-37690-2.patch @@ -0,0 +1,25 @@ +From d8e07ff51f9e709399b8c553290836fb308e45ed Mon Sep 17 00:00:00 2001 +From: geetachavan1 <53313357+geetachavan1@users.noreply.github.com> +Date: Tue, 27 Jul 2021 16:08:12 -0700 +Subject: [PATCH 1/1] Update shape_refiner.cc + +--- + tensorflow/core/common_runtime/shape_refiner.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tensorflow/core/common_runtime/shape_refiner.cc b/tensorflow/core/common_runtime/shape_refiner.cc +index 6a7d1eadfb6..906bd14f96c 100644 +--- a/tensorflow/core/common_runtime/shape_refiner.cc ++++ b/tensorflow/core/common_runtime/shape_refiner.cc +@@ -132,7 +132,7 @@ Status InferShapesForFunctionSubNode(const Node* node, ShapeRefiner* refiner, + TF_RETURN_IF_ERROR( + outer_context->MakeShapeFromShapeProto(proto, &handle)); + copied_shapes_and_types.push_back( +- ShapeAndType(handle, shape_and_type.dtype, shape_and_type.type)); ++ ShapeAndType(handle, shape_and_type.dtype, shape_and_type.specialized_type)); + } + + outer_context->set_output_handle_shapes_and_types( +-- +2.27.0 + diff --git a/CVE-2021-37690-3.patch b/CVE-2021-37690-3.patch new file mode 100644 index 0000000..77baffb --- /dev/null +++ b/CVE-2021-37690-3.patch @@ -0,0 +1,25 @@ +From 106316a9077cfabca5d54721650c9a65fef4dc6a Mon Sep 17 00:00:00 2001 +From: Mihai Maruseac +Date: Sat, 7 Aug 2021 17:18:11 -0700 +Subject: [PATCH 1/1] Fix build + +--- + tensorflow/core/common_runtime/shape_refiner.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tensorflow/core/common_runtime/shape_refiner.cc b/tensorflow/core/common_runtime/shape_refiner.cc +index 906bd14f96c..3c5421a9507 100644 +--- a/tensorflow/core/common_runtime/shape_refiner.cc ++++ b/tensorflow/core/common_runtime/shape_refiner.cc +@@ -132,7 +132,7 @@ Status InferShapesForFunctionSubNode(const Node* node, ShapeRefiner* refiner, + TF_RETURN_IF_ERROR( + outer_context->MakeShapeFromShapeProto(proto, &handle)); + copied_shapes_and_types.push_back( +- ShapeAndType(handle, shape_and_type.dtype, shape_and_type.specialized_type)); ++ ShapeAndType(handle, shape_and_type.dtype)); + } + + outer_context->set_output_handle_shapes_and_types( +-- +2.27.0 + diff --git a/tensorflow.spec b/tensorflow.spec index a9d1c38..d88f38b 100644 --- a/tensorflow.spec +++ b/tensorflow.spec @@ -1,7 +1,7 @@ %global _empty_manifest_terminate_build 0 Name: tensorflow Version: 2.3.1 -Release: 9 +Release: 10 Summary: An Open Source Machine Learning Framework for Everyone License: Apache License 2.0 URL: https://www.tensorflow.org/ @@ -185,6 +185,9 @@ Patch0173: CVE-2021-29516-2.patch Patch0174: CVE-2021-29516-3.patch Patch0175: CVE-2021-29516-4.patch Patch0176: CVE-2021-37679.patch +Patch0177: CVE-2021-37690-1.patch +Patch0178: CVE-2021-37690-2.patch +Patch0179: CVE-2021-37690-3.patch Requires: python3-future Requires: python3-numpy @@ -231,6 +234,9 @@ bazel --output_user_root=`pwd`/../output_user_root build --host_copt=-Wno-string %{_bindir}/* %changelog +* Thu Sep 16 2021 yaoxin - 2.3.1-10 +- Fix CVE-2021-37690 + * Mon Sep 13 2021 houyingchao - 2.3.1-9 - Fix CVE-2020-26267 CVE-2021-29515 CVE-2021-29551 CVE-2021-37645 CVE-2021-37681 CVE-2021-29516 CVE-2021-37679 -- Gitee