Vulnerability Details : CVE-2022-41911
TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a `const char*` array (since that's the underlying storage) and then we typecast it to the element type. However, conversions from `char` to `bool` are undefined if the `char` is not `0` or `1`, so sanitizers/fuzzers will crash. The issue has been patched in GitHub commit `1be74370327`. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.10.1, TensorFlow 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Products affected by CVE-2022-41911
- cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.10.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-41911
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 40 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-41911
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST | |
|
4.8
|
MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H |
1.2
|
3.6
|
GitHub, Inc. |
CWE ids for CVE-2022-41911
-
The product does not correctly convert an object, resource, or structure from one type to a different type.Assigned by: security-advisories@github.com (Primary)
References for CVE-2022-41911
-
https://github.com/tensorflow/tensorflow/blob/807cae8a807960fd7ac2313cde73a11fc15e7942/tensorflow/core/framework/tensor.cc#L1200-L1227
Patch;Third Party Advisory
-
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pf36-r9c6-h97j
Invalid char to bool conversion when printing a tensor · Advisory · tensorflow/tensorflow · GitHubPatch;Third Party Advisory
-
https://github.com/tensorflow/tensorflow/commit/1be743703279782a357adbf9b77dcb994fe8b508
Resolve a sanitizer issue with invalid char -> bool conversion. · tensorflow/tensorflow@1be7437 · GitHubPatch;Third Party Advisory
Jump to