Skip to content

Commit 1e3d06f

Browse files
sirutBuasaisirutBuasai
authored
patch tf 2.18 arm64 (#5384)
1 parent e96a7be commit 1e3d06f

File tree

2 files changed

+232
-0
lines changed

2 files changed

+232
-0
lines changed

‎tensorflow/inference/docker/2.18/py3/Dockerfile.ec2.arm64.cpu.os_scan_allowlist.json‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -788,6 +788,122 @@
788788
"status": "ACTIVE",
789789
"title": "CVE-2023-52757 - linux-libc-dev",
790790
"reason_to_ignore": "N/A"
791+
},
792+
{
793+
"description": "In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] Read of size 8 at addr ffff888136335380 by task kworker/6:0/140241 CPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G E 6.14.0-rc6+ #1 Tainted: [E]=UNSIGNED_MODULE Hardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024 Workqueue: events rtsx_usb_ms_poll_card [rtsx_usb_ms] Call Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x27/0x320 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] print_report+0x3e/0x70 kasan_report+0xab/0xe0 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] ? __pfx_rtsx_usb_ms_poll_card+0x10/0x10 [rtsx_usb_ms] ? __pfx___schedule+0x10/0x10 ? kick_pool+0x3b/0x270 process_",
794+
"vulnerability_id": "CVE-2025-22020",
795+
"name": "CVE-2025-22020",
796+
"package_name": "linux-libc-dev",
797+
"package_details": {
798+
"file_path": null,
799+
"name": "linux-libc-dev",
800+
"package_manager": "OS",
801+
"version": "5.4.0",
802+
"release": "216.236"
803+
},
804+
"remediation": {
805+
"recommendation": {
806+
"text": "None Provided"
807+
}
808+
},
809+
"cvss_v3_score": 7.8,
810+
"cvss_v30_score": 0.0,
811+
"cvss_v31_score": 7.8,
812+
"cvss_v2_score": 0.0,
813+
"cvss_v3_severity": "HIGH",
814+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-22020.html",
815+
"source": "UBUNTU_CVE",
816+
"severity": "HIGH",
817+
"status": "ACTIVE",
818+
"title": "CVE-2025-22020 - linux-libc-dev",
819+
"reason_to_ignore": "N/A"
820+
},
821+
{
822+
"description": "In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2cap_connect [Syzbot reported] BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54 CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Workqueue: hci2 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline] l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline] ",
823+
"vulnerability_id": "CVE-2024-49950",
824+
"name": "CVE-2024-49950",
825+
"package_name": "linux-libc-dev",
826+
"package_details": {
827+
"file_path": null,
828+
"name": "linux-libc-dev",
829+
"package_manager": "OS",
830+
"version": "5.4.0",
831+
"release": "216.236"
832+
},
833+
"remediation": {
834+
"recommendation": {
835+
"text": "None Provided"
836+
}
837+
},
838+
"cvss_v3_score": 7.8,
839+
"cvss_v30_score": 0.0,
840+
"cvss_v31_score": 7.8,
841+
"cvss_v2_score": 0.0,
842+
"cvss_v3_severity": "HIGH",
843+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-49950.html",
844+
"source": "UBUNTU_CVE",
845+
"severity": "HIGH",
846+
"status": "ACTIVE",
847+
"title": "CVE-2024-49950 - linux-libc-dev",
848+
"reason_to_ignore": "N/A"
849+
},
850+
{
851+
"description": "In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 Call Trace: <IRQ> dump_stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_write_timer_handler+0x156/0x3e0 tcp_write_timer+0x66/0x170 call_timer_fn+0xfb/0x1d0 __run_timers+0x3f8/0x480 run_timer_softirq+0x9b/0x100 handle_softirqs+0x153/0x390 __irq_exit_rcu+0x103/0x120 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 <fa> c3 cc",
852+
"vulnerability_id": "CVE-2024-53168",
853+
"name": "CVE-2024-53168",
854+
"package_name": "linux-libc-dev",
855+
"package_details": {
856+
"file_path": null,
857+
"name": "linux-libc-dev",
858+
"package_manager": "OS",
859+
"version": "5.4.0",
860+
"release": "216.236"
861+
},
862+
"remediation": {
863+
"recommendation": {
864+
"text": "None Provided"
865+
}
866+
},
867+
"cvss_v3_score": 7.8,
868+
"cvss_v30_score": 0.0,
869+
"cvss_v31_score": 7.8,
870+
"cvss_v2_score": 0.0,
871+
"cvss_v3_severity": "HIGH",
872+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-53168.html",
873+
"source": "UBUNTU_CVE",
874+
"severity": "HIGH",
875+
"status": "ACTIVE",
876+
"title": "CVE-2024-53168 - linux-libc-dev",
877+
"reason_to_ignore": "N/A"
878+
},
879+
{
880+
"description": "In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds read in ea_get() During the \"size_check\" label in ea_get(), the code checks if the extended attribute list (xattr) size matches ea_size. If not, it logs \"ea_get: invalid extended attribute\" and calls print_hex_dump(). Here, EALIST_SIZE(ea_buf->xattr) returns 4110417968, which exceeds INT_MAX (2,147,483,647). Then ea_size is clamped: int size = clamp_t(int, ea_size, 0, EALIST_SIZE(ea_buf->xattr)); Although clamp_t aims to bound ea_size between 0 and 4110417968, the upper limit is treated as an int, causing an overflow above 2^31 - 1. This leads \"size\" to wrap around and become negative (-184549328). The \"size\" is then passed to print_hex_dump() (called \"len\" in print_hex_dump()), it is passed as type size_t (an unsigned type), this is then stored inside a variable called \"int remaining\", which is then assigned to \"int linelen\" which is then passed to hex_dump_to_buffer(). In print_hex_dump() the for loop, iterates t",
881+
"vulnerability_id": "CVE-2025-39735",
882+
"name": "CVE-2025-39735",
883+
"package_name": "linux-libc-dev",
884+
"package_details": {
885+
"file_path": null,
886+
"name": "linux-libc-dev",
887+
"package_manager": "OS",
888+
"version": "5.4.0",
889+
"release": "216.236"
890+
},
891+
"remediation": {
892+
"recommendation": {
893+
"text": "None Provided"
894+
}
895+
},
896+
"cvss_v3_score": 7.1,
897+
"cvss_v30_score": 0.0,
898+
"cvss_v31_score": 7.1,
899+
"cvss_v2_score": 0.0,
900+
"cvss_v3_severity": "HIGH",
901+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-39735.html",
902+
"source": "UBUNTU_CVE",
903+
"severity": "HIGH",
904+
"status": "ACTIVE",
905+
"title": "CVE-2025-39735 - linux-libc-dev",
906+
"reason_to_ignore": "N/A"
791907
}
792908
]
793909
}

‎tensorflow/inference/docker/2.18/py3/Dockerfile.sagemaker.arm64.cpu.os_scan_allowlist.json‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -788,6 +788,122 @@
788788
"status": "ACTIVE",
789789
"title": "CVE-2025-22035 - linux-libc-dev",
790790
"reason_to_ignore": "N/A"
791+
},
792+
{
793+
"description": "In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds read in ea_get() During the \"size_check\" label in ea_get(), the code checks if the extended attribute list (xattr) size matches ea_size. If not, it logs \"ea_get: invalid extended attribute\" and calls print_hex_dump(). Here, EALIST_SIZE(ea_buf->xattr) returns 4110417968, which exceeds INT_MAX (2,147,483,647). Then ea_size is clamped: int size = clamp_t(int, ea_size, 0, EALIST_SIZE(ea_buf->xattr)); Although clamp_t aims to bound ea_size between 0 and 4110417968, the upper limit is treated as an int, causing an overflow above 2^31 - 1. This leads \"size\" to wrap around and become negative (-184549328). The \"size\" is then passed to print_hex_dump() (called \"len\" in print_hex_dump()), it is passed as type size_t (an unsigned type), this is then stored inside a variable called \"int remaining\", which is then assigned to \"int linelen\" which is then passed to hex_dump_to_buffer(). In print_hex_dump() the for loop, iterates t",
794+
"vulnerability_id": "CVE-2025-39735",
795+
"name": "CVE-2025-39735",
796+
"package_name": "linux-libc-dev",
797+
"package_details": {
798+
"file_path": null,
799+
"name": "linux-libc-dev",
800+
"package_manager": "OS",
801+
"version": "5.4.0",
802+
"release": "216.236"
803+
},
804+
"remediation": {
805+
"recommendation": {
806+
"text": "None Provided"
807+
}
808+
},
809+
"cvss_v3_score": 7.1,
810+
"cvss_v30_score": 0.0,
811+
"cvss_v31_score": 7.1,
812+
"cvss_v2_score": 0.0,
813+
"cvss_v3_severity": "HIGH",
814+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-39735.html",
815+
"source": "UBUNTU_CVE",
816+
"severity": "HIGH",
817+
"status": "ACTIVE",
818+
"title": "CVE-2025-39735 - linux-libc-dev",
819+
"reason_to_ignore": "N/A"
820+
},
821+
{
822+
"description": "In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2cap_connect [Syzbot reported] BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54 CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Workqueue: hci2 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 l2cap_connect_req net/bluetooth/l2cap_core.c:4080 [inline] l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:4772 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5543 [inline] ",
823+
"vulnerability_id": "CVE-2024-49950",
824+
"name": "CVE-2024-49950",
825+
"package_name": "linux-libc-dev",
826+
"package_details": {
827+
"file_path": null,
828+
"name": "linux-libc-dev",
829+
"package_manager": "OS",
830+
"version": "5.4.0",
831+
"release": "216.236"
832+
},
833+
"remediation": {
834+
"recommendation": {
835+
"text": "None Provided"
836+
}
837+
},
838+
"cvss_v3_score": 7.8,
839+
"cvss_v30_score": 0.0,
840+
"cvss_v31_score": 7.8,
841+
"cvss_v2_score": 0.0,
842+
"cvss_v3_severity": "HIGH",
843+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-49950.html",
844+
"source": "UBUNTU_CVE",
845+
"severity": "HIGH",
846+
"status": "ACTIVE",
847+
"title": "CVE-2024-49950 - linux-libc-dev",
848+
"reason_to_ignore": "N/A"
849+
},
850+
{
851+
"description": "In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 Call Trace: <IRQ> dump_stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_write_timer_handler+0x156/0x3e0 tcp_write_timer+0x66/0x170 call_timer_fn+0xfb/0x1d0 __run_timers+0x3f8/0x480 run_timer_softirq+0x9b/0x100 handle_softirqs+0x153/0x390 __irq_exit_rcu+0x103/0x120 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 <fa> c3 cc",
852+
"vulnerability_id": "CVE-2024-53168",
853+
"name": "CVE-2024-53168",
854+
"package_name": "linux-libc-dev",
855+
"package_details": {
856+
"file_path": null,
857+
"name": "linux-libc-dev",
858+
"package_manager": "OS",
859+
"version": "5.4.0",
860+
"release": "216.236"
861+
},
862+
"remediation": {
863+
"recommendation": {
864+
"text": "None Provided"
865+
}
866+
},
867+
"cvss_v3_score": 7.8,
868+
"cvss_v30_score": 0.0,
869+
"cvss_v31_score": 7.8,
870+
"cvss_v2_score": 0.0,
871+
"cvss_v3_severity": "HIGH",
872+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-53168.html",
873+
"source": "UBUNTU_CVE",
874+
"severity": "HIGH",
875+
"status": "ACTIVE",
876+
"title": "CVE-2024-53168 - linux-libc-dev",
877+
"reason_to_ignore": "N/A"
878+
},
879+
{
880+
"description": "In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] Read of size 8 at addr ffff888136335380 by task kworker/6:0/140241 CPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G E 6.14.0-rc6+ #1 Tainted: [E]=UNSIGNED_MODULE Hardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024 Workqueue: events rtsx_usb_ms_poll_card [rtsx_usb_ms] Call Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x27/0x320 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] print_report+0x3e/0x70 kasan_report+0xab/0xe0 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] ? __pfx_rtsx_usb_ms_poll_card+0x10/0x10 [rtsx_usb_ms] ? __pfx___schedule+0x10/0x10 ? kick_pool+0x3b/0x270 process_",
881+
"vulnerability_id": "CVE-2025-22020",
882+
"name": "CVE-2025-22020",
883+
"package_name": "linux-libc-dev",
884+
"package_details": {
885+
"file_path": null,
886+
"name": "linux-libc-dev",
887+
"package_manager": "OS",
888+
"version": "5.4.0",
889+
"release": "216.236"
890+
},
891+
"remediation": {
892+
"recommendation": {
893+
"text": "None Provided"
894+
}
895+
},
896+
"cvss_v3_score": 7.8,
897+
"cvss_v30_score": 0.0,
898+
"cvss_v31_score": 7.8,
899+
"cvss_v2_score": 0.0,
900+
"cvss_v3_severity": "HIGH",
901+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-22020.html",
902+
"source": "UBUNTU_CVE",
903+
"severity": "HIGH",
904+
"status": "ACTIVE",
905+
"title": "CVE-2025-22020 - linux-libc-dev",
906+
"reason_to_ignore": "N/A"
791907
}
792908
]
793909
}

0 commit comments

Comments
 (0)