GHSA-q8qj-fc9q-cphr Undefined behavior in Tensorflow

• PyPI tensorflow: >= 2.2.0, < 2.2.1 → fixed in 2.2.1 • PyPI tensorflow: >= 2.3.0, < 2.3.1 → fixed in 2.3.1 • PyPI tensorflow-cpu: >= 2.2.0, < 2.2.1 → fixed in 2.2.1 • PyPI tensorflow-cpu: >= 2.3.0, < 2.3.1 → fixed in 2.3.1 • PyPI tensorflow-gpu: >= 2.2.0, < 2.2.1 → fixed in 2.2.1 • PyPI tensorflow-gpu: >= 2.3.0, < 2.3.1 → fixed in 2.3.1

Impact If a user passes an invalid argument to `dlpack.to_dlpack` the expected validations will cause variables to bind to `nullptr` while setting a `status` variable to the error condition. However, this `status` argument is not properly checked: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L265-L267 Hence, code following these methods will bind references to null pointers: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L279-L285 This is undefined behavior and reported as an error if compiling with `-fsanitize=null`. Patches We have patched the issue in 22e07fb204386768e5bcbea563641ea11f96ceb8 and will release a patch release for all affected versions. We recommend users to upgrade to TensorFlow 2.2.1 or 2.3.1. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been discovered during variant analysis of GHSA-rjjg-hgv6-h69v.