AI Sec Watch

TensorFlow, an open source platform for machine learning, has a vulnerability in the `tf.histogram_fixed_width` function where it crashes if the input data contains NaN (Not a Number, a special floating point value representing undefined results). The crash happens because the code tries to convert NaN to an integer without checking for it first, and this bug only affects the CPU version of TensorFlow.

TensorFlow version 2.8.0 had a bug in the `TensorKey` hash function (a function that converts data into a fixed-size code for quick lookups), where it incorrectly used `AllocatedBytes()` (an estimate of memory used by a tensor, including referenced data like strings) to access the actual tensor data bytes. This caused crashes because `AllocatedBytes()` doesn't represent the real contiguous memory buffer, and certain data types like `tstring` contain pointers rather than actual values.

TensorFlow, an open source machine learning platform, had a bug in versions before 2.9.0, 2.8.1, 2.7.2, and 2.6.4 where assertion macros (special code blocks that check if conditions are true) incorrectly compared different data types, specifically `size_t` and `int` values (two different ways to store whole numbers). This type confusion could cause assertions to trigger incorrectly due to how the computer converts between these different number types.

TensorFlow, an open source platform for machine learning, has a vulnerability in the `tf.raw_ops.EditDistance` function where incomplete validation allows users to pass negative values that cause a segmentation fault (a program crash from accessing invalid memory). An attacker could exploit this by crafting input that produces negative array indices, allowing writes before the intended array location and potentially crashing the system.

CVE-2022-29206 is a bug in TensorFlow (an open source machine learning platform) where a specific function called `tf.raw_ops.SparseTensorDenseAdd` doesn't properly check its input arguments, causing a nullptr (a reference pointing to nothing) to be accessed during execution, which leads to undefined behavior. This vulnerability affects TensorFlow versions before 2.9.0, 2.8.1, 2.7.2, and 2.6.4.

TensorFlow (an open-source machine learning platform) has a bug in older versions where calling certain compatibility functions with unsupported data types causes the program to crash. When the code tries to process a missing function, it attempts to use a null pointer (a reference to nothing in memory), which causes a segmentation fault (a type of crash where the program accesses memory it shouldn't).

TensorFlow, an open source platform for machine learning, has a vulnerability in one of its operations called `tf.raw_ops.UnsortedSegmentJoin` where it doesn't properly check its inputs before using them. If someone provides a negative number where a positive one is expected, it causes the program to crash with an assertion failure, which is a type of denial of service attack (making software unavailable by crashing it).

CVE-2022-29203 is a vulnerability in TensorFlow (an open source platform for machine learning) where a function called `tf.raw_ops.SpaceToBatchND` has an integer overflow bug (a situation where a calculation produces a number too large for the system to handle). This overflow causes a denial of service (making the system crash or become unavailable) when the buggy code tries to allocate memory for output data.

A vulnerability in TensorFlow (an open source platform for machine learning) versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4 allows attackers to cause a denial of service (making a system unavailable by consuming all available memory) by exploiting the `tf.ragged.constant` function, which does not properly check its input arguments. The vulnerability exists because of improper input validation (checking that data meets expected requirements before using it).