OSSForks/tensorflow
1
0
Fork 0
mirror of https://github.com/zebrajr/tensorflow.git synced 2025-12-06 00:19:58 +01:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

Merge pull request #61066 from computerscienceiscool:patch-1

Browse Source 
PiperOrigin-RevId: 543453661
This commit is contained in:
TensorFlower Gardener 2023-06-26 09:07:13 -07:00
commit 2fe6b745ea
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
SECURITY.md
View File

@ -229,11 +229,11 @@ and [the Google OSS VRP
rules](https://bughunters.google.com/about/rules/6521337925468160/google-open-source-software-vulnerability-reward-program-rules)).
**Note**: Although the iterative exploration of TF API via fuzzing
`tf.raw_ops.xxx` symbols is the best way to uncover code weakeness, please bear
in mind that this is not a typical usecase that has security implications. It is
better to try to translate the vulnerability to something that can be exploited
during training or inference of a model (i.e., build a model that when given a
specific input would produce unwanted behavior). Alternatively, if the
`tf.raw_ops.xxx` symbols is the best way to uncover code weakness, please bear
in mind that this is not a typical use case that has security implications. It
is better to try to translate the vulnerability to something that can be
exploited during training or inference of a model (i.e., build a model that when
given a specific input would produce unwanted behavior). Alternatively, if the
TensorFlow API is only used in ancillary tooling, consider the environment where
the tool would run. For example, if `saved_model_cli` tool would crash on
parsing a `SavedModel` that is not considered a vulnerability but a bug (since
@ -254,7 +254,7 @@ In addition, please include the following information along with your report:
* Your name and affiliation (if any).
* A description of the technical details of the vulnerabilities. It is very
important to let us know how we can reproduce your findings.
* A minimal example of the vulnerabity.
* A minimal example of the vulnerability.
* An explanation of who can exploit this vulnerability, and what they gain
when doing so -- write an attack scenario. This will help us evaluate your
report quickly, especially if the issue is complex.