CVE-2022-36011 TensorFlow is a machine learning platform. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` gives empty function attributes, it gives a null dereference.

This issue was reported by @sjohantvergessen. We are sorry that we have taken so much time to patch this issue. This fix has been cherry-picked on TensorFlow 2.10.0 and will be included in TensorFlow 2.9.1. We are sorry that we have taken so much time to patch this issue. This fix has been cherry-picked on TensorFlow 2.10.0 and will be included in TensorFlow 2.9.1.

Summary

We are sorry that we have taken so much time to patch this issue. This fix has been cherry-picked on TensorFlow 2.10.0 and will be included in TensorFlow 2.9.1

Description of the Issue

On a Mac, when you create a new TensorFlow 2.9.1 Python project and compile it, scopes are generated with a capital C.

Issue: The build_graph function does not respect graph_dir parameter

The build_graph function does not respect graph_dir parameter. This change fixes an issue where the build_graph function would fail and return an error code when graph_dir is set but is not that of a file system directory. With this fix, the build will succeed even if the specified directory does not exist on the file system.

CVE-2022-36012

This issue was reported by @sjohantvergessen. We are sorry that we have taken so much time to patch this issue. This fix has been cherry-picked on TensorFlow 2.10.0 and will be included in TensorFlow 2.9.1.

Timeline

Published on: 09/16/2022 23:15:00 UTC
Last modified on: 09/20/2022 14:40:00 UTC

References

• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-fv43-93gv-vm8f
• https://github.com/tensorflow/tensorflow/commit/1cf45b831eeb0cab8655c9c7c5d06ec6f45fc41b
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-36011