AVID-2026-R1157

Description

Invalid char to bool conversion when printing a tensor in Tensorflow (CVE-2022-41911)

Details

TensorFlow is an open source platform for machine learning. When printing a tensor, we get it’s data as a const char* array (since that’s the underlying storage) and then we typecast it to the element type. However, conversions from char to bool are undefined if the char is not 0 or 1, so sanitizers/fuzzers will crash. The issue has been patched in GitHub commit 1be74370327. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.10.1, TensorFlow 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

Reason for inclusion in AVID: CVE-2022-41911 describes a vulnerability in TensorFlow (an AI framework) related to invalid char-to-bool conversions when printing tensors, leading to undefined behavior and potential crash. TensorFlow is a core dependency in many general-purpose AI systems, so this constitutes a software supply-chain vulnerability in components used to build/train/deploy/run AI systems. The report provides details, patch info, and references, fulfilling evidence requirements.

References

Affected or Relevant Artifacts

Developer: tensorflow
Deployer: tensorflow
Artifact Details:

Type	Name
System	tensorflow

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
Base Score	4.8
Base Severity	🟠 Medium
Attack Vector	NETWORK
Attack Complexity	🔴 High
Privileges Required	🟢 Low
User Interaction	REQUIRED
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	🔴 High

CWE

ID	Description
CWE-704	CWE-704: Incorrect Type Conversion or Cast

Other information

Report Type: Advisory
Credits:
Date Reported: 2022-11-18
Version: 0.3.3
AVID Entry