OSSForks/tensorflow
1
0
Fork 0
mirror of https://github.com/zebrajr/tensorflow.git synced 2026-01-15 12:15:41 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

Rewords the SECURITY.md regarding handling check fail errors.

Browse Source 
PiperOrigin-RevId: 473779036
This commit is contained in:
A. Unique TensorFlower
2022-09-12 10:13:58 -07:00
committed by TensorFlower Gardener
parent 620ab3e167
commit f4ebcc7602
1 changed files with 8 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
SECURITY.md
View File

@@ -157,15 +157,14 @@ One of the most critical parts of any system is input handling. If malicious
input can trigger side effects or incorrect behavior, this is a bug, and likely
a vulnerability.
**Note**: Assertion failures used to be considered a vulnerability in TensorFlow
but, due to technical debt and the large number of them, coupled with the fact
that an assertion failure may only lead to program termination and no other
exploit, we will no longer consider assertion failures (e.g., `CHECK`-fails) as
vulnerabilities. However, if the assertion failure occurs only in debug mode
(e.g., `DCHECK`) and in production-optimized mode the issue turns into other
code weakeness (e.g., heap overflow, etc.), then we will consider this to be a
vulnerability. We recommend reporters to try to maximize the impact of the
vulnerability report (see also [the Google VRP
**Note**: Assertion failures used to be considered a vulnerability in
TensorFlow. If an assertion failure only leads to program termination and no
other exploits, we will no longer consider assertion failures (e.g.,
`CHECK`-fails) as vulnerabilities. However, if the assertion failure occurs only
in debug mode (e.g., `DCHECK`) and in production-optimized mode the issue turns
into other code weakness(e.g., heap overflow, etc.), then we will consider
this to be a vulnerability. We recommend reporters to try to maximize the impact
of the vulnerability report (see also [the Google VRP
rules](https://bughunters.google.com/about/rules/6625378258649088/google-and-alphabet-vulnerability-reward-program-vrp-rules)
and [the Google OSS VRP
rules](https://bughunters.google.com/about/rules/6521337925468160/google-open-source-software-vulnerability-reward-program-rules)).