AI Sec Watch

TensorFlow (an open-source machine learning framework) has a vulnerability where the GraphDef format (TensorFlow's way of representing computation graphs) can accept self-recursive functions even though it shouldn't, causing a stack overflow (a crash from too much memory use) when the model runs because the system gets stuck trying to resolve the same function repeatedly.

TensorFlow (an open source machine learning framework) has a vulnerability where a maliciously altered GraphDef (a representation of a machine learning model's computation graph) from a SavedModel can crash a TensorFlow process by forcing extraction of a value from a StatusOr (a data structure that holds either a valid result or an error state). The issue affects both TensorFlow 2.7 and 2.8 versions.

TensorFlow, a machine learning framework, has a vulnerability (CVE-2022-23589) in its Grappler component (a graph optimization tool) that can cause a null pointer dereference (crash from accessing invalid memory) when processing maliciously altered SavedModel files (serialized machine learning models). The bug occurs in two places during optimization operations and can be triggered by missing required nodes in the computation graph.

A malicious user can crash TensorFlow (an open source machine learning framework) by modifying a SavedModel (a pre-trained model file) in a way that tricks the Grappler optimizer (a tool that improves model performance) into building a tensor with an invalid reference dtype (data type), causing the program to fail.

TensorFlow, an open-source machine learning framework, has a vulnerability in its Grappler component (a tool that optimizes computational graphs) that causes an integer overflow (when a number becomes too large to store) during cost estimation for crop and resize operations. Since attackers can control the cropping parameters, they can trigger undefined behavior (unpredictable actions that may crash the system or cause other problems).

A vulnerability in TensorFlow (an open-source machine learning framework) allows an attacker to cause a denial of service by modifying a SavedModel (a packaged version of a trained model) in a way that triggers false assertions in the code and crashes the Python interpreter. This vulnerability affects multiple versions of TensorFlow.

TensorFlow, an open-source machine learning framework, has a memory leak (unused memory that is not freed) when decoding invalid PNG image files. The problem occurs because error-handling code exits the function early without properly freeing allocated buffers (chunks of memory that were set aside for use).

TensorFlow (an open-source machine learning framework) has a vulnerability where a malicious user can trigger a use after free bug (accessing memory that has already been freed) when decoding PNG images. The problem occurs because after a memory cleanup function is called, the width and height values are left in an unpredictable state.

A vulnerability in TensorFlow (an open-source machine learning framework) allows a malicious user to cause a denial of service (making a service unavailable) by modifying a SavedModel (a format for storing trained models) so that binary operations receive corrupted data due to type confusion (using data as if it were a different type than it actually is). This type mismatch between expected and actual data types can cause the program to crash.