Lucene search

K
githubGitHub Advisory DatabaseGHSA-PF36-R9C6-H97J
HistoryNov 21, 2022 - 10:18 p.m.

Invalid char to bool conversion when printing a tensor

2022-11-2122:18:11
CWE-704
GitHub Advisory Database
github.com
18
tensorflow
conversion
undefined
patched
security model

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

38.6%

Impact

When printing a tensor, we get it’s data as a const char* array (since that’s the underlying storage) and then we typecast it to the element type. However, conversions from char to bool are undefined if the char is not 0 or 1, so sanitizers/fuzzers will crash.

Patches

We have patched the issue in GitHub commit 1be743703279782a357adbf9b77dcb994fe8b508.

The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.10.1, TensorFlow 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability was discovered via internal fuzzing.

Affected configurations

Vulners
Node
tensorflowcpuRange<2.10.1
OR
tensorflowgpuRange<2.9.3
OR
tensorflowgpuRange<2.8.4
OR
tensorflowcpuRange<2.8.4
OR
github_advisory_databasetensorflowRange<2.10.1
OR
github_advisory_databasetensorflowRange<2.9.3
OR
tensorflowgpuRange<2.10.1
OR
tensorflowcpuRange<2.9.3
OR
github_advisory_databasetensorflowRange<2.8.4

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

38.6%