Skip to content

Commit 9e144ac

Browse files
jinyan-li1jinyan-li1
authored
Tensorflow Inference 2.18 & 2.19 CVE patch (#5093)
Tensorflow Inference 2.18 & 2.19 CVE patch
1 parent cdf0eb3 commit 9e144ac

9 files changed

+941
-4
lines changed

‎tensorflow/inference/buildspec-2-18-ec2.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ framework: &FRAMEWORK tensorflow
55
version: &VERSION 2.18.0
66
short_version: &SHORT_VERSION 2.18
77
arch_type: x86
8-
autopatch_build: "True"
8+
# autopatch_build: "True"
99

1010
repository_info:
1111
inference_repository: &INFERENCE_REPOSITORY

‎tensorflow/inference/buildspec-2-18-sm.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ framework: &FRAMEWORK tensorflow
55
version: &VERSION 2.18.0
66
short_version: &SHORT_VERSION 2.18
77
arch_type: x86
8-
autopatch_build: "True"
8+
# autopatch_build: "True"
99

1010
repository_info:
1111
inference_repository: &INFERENCE_REPOSITORY

‎tensorflow/inference/buildspec-2-19-sm.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ framework: &FRAMEWORK tensorflow
55
version: &VERSION 2.19.0
66
short_version: &SHORT_VERSION 2.19
77
arch_type: x86
8-
autopatch_build: "True"
8+
# autopatch_build: "True"
99

1010
repository_info:
1111
inference_repository: &INFERENCE_REPOSITORY

‎tensorflow/inference/docker/2.18/py3/Dockerfile.ec2.cpu.os_scan_allowlist.json

Lines changed: 227 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -379,5 +379,232 @@
379379
"title": "CVE-2022-45939 - emacs, emacs-common and 1 more",
380380
"reason_to_ignore": "N/A"
381381
}
382+
],
383+
"linux-libc-dev": [
384+
{
385+
"description": "In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their CPU masks and unconditionally accesses per-CPU data for the first CPU of each mask. According to Documentation/admin-guide/mm/numaperf.rst: \"Some memory may share the same node as a CPU, and others are provided as memory only nodes.\" Therefore, some node CPU masks may be empty and wouldn't have a \"first CPU\". On a machine with far memory (and therefore CPU-less NUMA nodes): - cpumask_of_node(nid) is 0 - cpumask_first(0) is CONFIG_NR_CPUS - cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an index that is 1 out of bounds This does not have any security implications since flashing microcode is a privileged operation but I believe this has reliability implications by potentially corrupting memory while flashing a microcode update. When booting with CONFIG_UBSAN_BOUNDS=y on an AMD ma",
386+
"vulnerability_id": "CVE-2025-21991",
387+
"name": "CVE-2025-21991",
388+
"package_name": "linux-libc-dev",
389+
"package_details": {
390+
"file_path": null,
391+
"name": "linux-libc-dev",
392+
"package_manager": "OS",
393+
"version": "5.4.0",
394+
"release": "216.236"
395+
},
396+
"remediation": { "recommendation": { "text": "None Provided" } },
397+
"cvss_v3_score": 7.8,
398+
"cvss_v30_score": 0.0,
399+
"cvss_v31_score": 7.8,
400+
"cvss_v2_score": 0.0,
401+
"cvss_v3_severity": "HIGH",
402+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-21991.html",
403+
"source": "UBUNTU_CVE",
404+
"severity": "HIGH",
405+
"status": "ACTIVE",
406+
"title": "CVE-2025-21991 - linux-libc-dev",
407+
"reason_to_ignore": "N/A"
408+
},
409+
{
410+
"description": "In the Linux kernel, the following vulnerability has been resolved: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix length is 64, this causes the shift exponent to become negative, triggering a UBSAN warning. As the concept of a subnet mask does not apply to IPv6, the value is set to ~0 to suppress the warning message.",
411+
"vulnerability_id": "CVE-2025-21993",
412+
"name": "CVE-2025-21993",
413+
"package_name": "linux-libc-dev",
414+
"package_details": {
415+
"file_path": null,
416+
"name": "linux-libc-dev",
417+
"package_manager": "OS",
418+
"version": "5.4.0",
419+
"release": "216.236"
420+
},
421+
"remediation": { "recommendation": { "text": "None Provided" } },
422+
"cvss_v3_score": 7.1,
423+
"cvss_v30_score": 0.0,
424+
"cvss_v31_score": 7.1,
425+
"cvss_v2_score": 0.0,
426+
"cvss_v3_severity": "HIGH",
427+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-21993.html",
428+
"source": "UBUNTU_CVE",
429+
"severity": "HIGH",
430+
"status": "ACTIVE",
431+
"title": "CVE-2025-21993 - linux-libc-dev",
432+
"reason_to_ignore": "N/A"
433+
},
434+
{
435+
"description": "In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 Call Trace: <IRQ> dump_stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_write_timer_handler+0x156/0x3e0 tcp_write_timer+0x66/0x170 call_timer_fn+0xfb/0x1d0 __run_timers+0x3f8/0x480 run_timer_softirq+0x9b/0x100 handle_softirqs+0x153/0x390 __irq_exit_rcu+0x103/0x120 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 <fa> c3 cc",
436+
"vulnerability_id": "CVE-2024-53168",
437+
"name": "CVE-2024-53168",
438+
"package_name": "linux-libc-dev",
439+
"package_details": {
440+
"file_path": null,
441+
"name": "linux-libc-dev",
442+
"package_manager": "OS",
443+
"version": "5.4.0",
444+
"release": "216.236"
445+
},
446+
"remediation": { "recommendation": { "text": "None Provided" } },
447+
"cvss_v3_score": 7.8,
448+
"cvss_v30_score": 0.0,
449+
"cvss_v31_score": 7.8,
450+
"cvss_v2_score": 0.0,
451+
"cvss_v3_severity": "HIGH",
452+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-53168.html",
453+
"source": "UBUNTU_CVE",
454+
"severity": "HIGH",
455+
"status": "ACTIVE",
456+
"title": "CVE-2024-53168 - linux-libc-dev",
457+
"reason_to_ignore": "N/A"
458+
},
459+
{
460+
"description": "In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix usage slab after free [ +0.000021] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000027] Read of size 8 at addr ffff8881b8605f88 by task amd_pci_unplug/2147 [ +0.000023] CPU: 6 PID: 2147 Comm: amd_pci_unplug Not tainted 6.10.0+ #1 [ +0.000016] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000016] Call Trace: [ +0.000008] <TASK> [ +0.000009] dump_stack_lvl+0x76/0xa0 [ +0.000017] print_report+0xce/0x5f0 [ +0.000017] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000019] ? srso_return_thunk+0x5/0x5f [ +0.000015] ? kasan_complete_mode_report_info+0x72/0x200 [ +0.000016] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000019] kasan_report+0xbe/0x110 [ +0.000015] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000023] __asan_report_load8_noabort+0x14/0x30 [ +0.000014] drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.00",
461+
"vulnerability_id": "CVE-2024-56551",
462+
"name": "CVE-2024-56551",
463+
"package_name": "linux-libc-dev",
464+
"package_details": {
465+
"file_path": null,
466+
"name": "linux-libc-dev",
467+
"package_manager": "OS",
468+
"version": "5.4.0",
469+
"release": "216.236"
470+
},
471+
"remediation": { "recommendation": { "text": "None Provided" } },
472+
"cvss_v3_score": 7.8,
473+
"cvss_v30_score": 0.0,
474+
"cvss_v31_score": 7.8,
475+
"cvss_v2_score": 0.0,
476+
"cvss_v3_severity": "HIGH",
477+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-56551.html",
478+
"source": "UBUNTU_CVE",
479+
"severity": "HIGH",
480+
"status": "ACTIVE",
481+
"title": "CVE-2024-56551 - linux-libc-dev",
482+
"reason_to_ignore": "N/A"
483+
},
484+
{
485+
"description": "In the Linux kernel, the following vulnerability has been resolved: net: atm: fix use after free in lec_send() The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.",
486+
"vulnerability_id": "CVE-2025-22004",
487+
"name": "CVE-2025-22004",
488+
"package_name": "linux-libc-dev",
489+
"package_details": {
490+
"file_path": null,
491+
"name": "linux-libc-dev",
492+
"package_manager": "OS",
493+
"version": "5.4.0",
494+
"release": "216.236"
495+
},
496+
"remediation": { "recommendation": { "text": "None Provided" } },
497+
"cvss_v3_score": 7.8,
498+
"cvss_v30_score": 0.0,
499+
"cvss_v31_score": 7.8,
500+
"cvss_v2_score": 0.0,
501+
"cvss_v3_severity": "HIGH",
502+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-22004.html",
503+
"source": "UBUNTU_CVE",
504+
"severity": "HIGH",
505+
"status": "ACTIVE",
506+
"title": "CVE-2025-22004 - linux-libc-dev",
507+
"reason_to_ignore": "N/A"
508+
},
509+
{
510+
"description": "In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] Read of size 8 at addr ffff888136335380 by task kworker/6:0/140241 CPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G E 6.14.0-rc6+ #1 Tainted: [E]=UNSIGNED_MODULE Hardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024 Workqueue: events rtsx_usb_ms_poll_card [rtsx_usb_ms] Call Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x27/0x320 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] print_report+0x3e/0x70 kasan_report+0xab/0xe0 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] ? __pfx_rtsx_usb_ms_poll_card+0x10/0x10 [rtsx_usb_ms] ? __pfx___schedule+0x10/0x10 ? kick_pool+0x3b/0x270 process_",
511+
"vulnerability_id": "CVE-2025-22020",
512+
"name": "CVE-2025-22020",
513+
"package_name": "linux-libc-dev",
514+
"package_details": {
515+
"file_path": null,
516+
"name": "linux-libc-dev",
517+
"package_manager": "OS",
518+
"version": "5.4.0",
519+
"release": "216.236"
520+
},
521+
"remediation": { "recommendation": { "text": "None Provided" } },
522+
"cvss_v3_score": 7.8,
523+
"cvss_v30_score": 0.0,
524+
"cvss_v31_score": 7.8,
525+
"cvss_v2_score": 0.0,
526+
"cvss_v3_severity": "HIGH",
527+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-22020.html",
528+
"source": "UBUNTU_CVE",
529+
"severity": "HIGH",
530+
"status": "ACTIVE",
531+
"title": "CVE-2025-22020 - linux-libc-dev",
532+
"reason_to_ignore": "N/A"
533+
},
534+
{
535+
"description": "In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds read in ea_get() During the \"size_check\" label in ea_get(), the code checks if the extended attribute list (xattr) size matches ea_size. If not, it logs \"ea_get: invalid extended attribute\" and calls print_hex_dump(). Here, EALIST_SIZE(ea_buf->xattr) returns 4110417968, which exceeds INT_MAX (2,147,483,647). Then ea_size is clamped: int size = clamp_t(int, ea_size, 0, EALIST_SIZE(ea_buf->xattr)); Although clamp_t aims to bound ea_size between 0 and 4110417968, the upper limit is treated as an int, causing an overflow above 2^31 - 1. This leads \"size\" to wrap around and become negative (-184549328). The \"size\" is then passed to print_hex_dump() (called \"len\" in print_hex_dump()), it is passed as type size_t (an unsigned type), this is then stored inside a variable called \"int remaining\", which is then assigned to \"int linelen\" which is then passed to hex_dump_to_buffer(). In print_hex_dump() the for loop, iterates t",
536+
"vulnerability_id": "CVE-2025-39735",
537+
"name": "CVE-2025-39735",
538+
"package_name": "linux-libc-dev",
539+
"package_details": {
540+
"file_path": null,
541+
"name": "linux-libc-dev",
542+
"package_manager": "OS",
543+
"version": "5.4.0",
544+
"release": "216.236"
545+
},
546+
"remediation": { "recommendation": { "text": "None Provided" } },
547+
"cvss_v3_score": 7.1,
548+
"cvss_v30_score": 0.0,
549+
"cvss_v31_score": 7.1,
550+
"cvss_v2_score": 0.0,
551+
"cvss_v3_severity": "HIGH",
552+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-39735.html",
553+
"source": "UBUNTU_CVE",
554+
"severity": "HIGH",
555+
"status": "ACTIVE",
556+
"title": "CVE-2025-39735 - linux-libc-dev",
557+
"reason_to_ignore": "N/A"
558+
},
559+
{
560+
"description": "In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show(): * One through 'iter->trace->print_line()'; * Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns. Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags. Moreover, when switching from the",
561+
"vulnerability_id": "CVE-2025-22035",
562+
"name": "CVE-2025-22035",
563+
"package_name": "linux-libc-dev",
564+
"package_details": {
565+
"file_path": null,
566+
"name": "linux-libc-dev",
567+
"package_manager": "OS",
568+
"version": "5.4.0",
569+
"release": "216.236"
570+
},
571+
"remediation": { "recommendation": { "text": "None Provided" } },
572+
"cvss_v3_score": 7.8,
573+
"cvss_v30_score": 0.0,
574+
"cvss_v31_score": 7.8,
575+
"cvss_v2_score": 0.0,
576+
"cvss_v3_severity": "HIGH",
577+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-22035.html",
578+
"source": "UBUNTU_CVE",
579+
"severity": "HIGH",
580+
"status": "ACTIVE",
581+
"title": "CVE-2025-22035 - linux-libc-dev",
582+
"reason_to_ignore": "N/A"
583+
},
584+
{
585+
"description": "In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API. Reproducer: # mount.cifs -o ...,seal,esize=1 //srv/share /mnt # dd if=/mnt/largefile of=/dev/null ... [ 194.196391] ================================================================== [ 194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110 [ 194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899 [ 194.197707] [ 194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43 [ 194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014 [ 194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs] [ 194.200032] Call Trace: [ 194.200191] <TASK> [ 194.200327] dump_stack_lvl+0x4e/0x70 [ 194.200558] ? gf128mul_4k_lle+0xc1/0x110 [ 194.200809] print_report+0x17",
586+
"vulnerability_id": "CVE-2024-50047",
587+
"name": "CVE-2024-50047",
588+
"package_name": "linux-libc-dev",
589+
"package_details": {
590+
"file_path": null,
591+
"name": "linux-libc-dev",
592+
"package_manager": "OS",
593+
"version": "5.4.0",
594+
"release": "216.236"
595+
},
596+
"remediation": { "recommendation": { "text": "None Provided" } },
597+
"cvss_v3_score": 7.8,
598+
"cvss_v30_score": 0.0,
599+
"cvss_v31_score": 7.8,
600+
"cvss_v2_score": 0.0,
601+
"cvss_v3_severity": "HIGH",
602+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-50047.html",
603+
"source": "UBUNTU_CVE",
604+
"severity": "HIGH",
605+
"status": "ACTIVE",
606+
"title": "CVE-2024-50047 - linux-libc-dev",
607+
"reason_to_ignore": "N/A"
608+
}
382609
]
383610
}

0 commit comments

Comments
 (0)