PT-2026-59842
تاريخ النشر
2026-07-09
·
تاريخ التحديث
2026-07-09
الوصف من
CVSS 3.1
5.9
متوسطةالمقاييسAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Impact
A
GraphDef from a TensorFlow SavedModel can be maliciously altered to cause a TensorFlow process to crash due to encountering a StatusOr value that is an error and forcibly extracting the value from it:cc
if (op reg data->type ctor != nullptr) {
VLOG(3) << "AddNode: found type constructor for " << node def.name();
const auto ctor type =
full type::SpecializeType(AttrSlice(node def), op reg data->op def);
const FullTypeDef ctor typedef = ctor type.ValueOrDie();
if (ctor typedef.type id() != TFT UNSET) {
*(node def.mutable experimental type()) = ctor typedef;
}
}If
ctor type is an error status, ValueOrDie results in a crash.Patches
We have patched the issue in GitHub commit 955059813cc325dc1db5e2daa6221271406d4439.
We have patched the issue in multiple GitHub commits and these will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1, as both are affected.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
قابلية الاستغلال
إصلاح
المورّدون
المنتجات المتأثرة
المعرّفات ذات الصلة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾