Lucene search

K
osvGoogleOSV:PYSEC-2022-136
HistoryFeb 04, 2022 - 11:15 p.m.

PYSEC-2022-136

2022-02-0423:15:00
Google
osv.dev
18
tensorflow
shape inference
dcheck
assertion failure
debug builds
fix
tensorflow 2.8.0
cherrypick
2.7.1
2.6.3
supported range

EPSS

0.001

Percentile

50.2%

Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, TensorFlow can fail to specialize a type during shape inference. This case is covered by the DCHECK function however, DCHECK is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the ValueOrDie line. This results in an assertion failure as ret contains an error Status, not a value. In the second case we also get a crash due to the assertion failure. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

EPSS

0.001

Percentile

50.2%