AI Sec Watch

TensorFlow, an open-source machine learning platform, has a vulnerability where attackers can cause a denial of service (making a system unavailable by crashing it) through a segmentation fault (a memory error that crashes a program) in the MaxPoolGrad operation due to missing input validation on certain data structures called tensors. The vulnerability exists because an earlier fix for a related issue was incomplete.

TensorFlow, an open-source machine learning platform, has a vulnerability where attackers can crash the system (denial of service, a type of attack that makes a service unavailable) through a function called `tf.raw_ops.MapStage` because it doesn't validate that the `key` input is a proper non-empty tensor (a multi-dimensional array of numbers). This bug affects multiple versions of TensorFlow.

TensorFlow, an open source machine learning platform, has a vulnerability where an attacker can read data outside the intended memory bounds (a heap overflow, which is when a program accesses memory it shouldn't) by sending specially crafted invalid arguments to a function called tf.raw_ops.SdcaOptimizerV2. The vulnerability exists because the code doesn't verify that the length of input labels matches the number of examples being processed.

TensorFlow, an open source machine learning platform, has a vulnerability where attackers can read data outside the intended memory bounds by sending specially crafted arguments to certain functions like `tf.raw_ops.UpperBound` and `tf.raw_ops.LowerBound`. The vulnerability exists because the code doesn't properly validate the rank (the number of dimensions) of the input data it receives. This could allow attackers to access sensitive information stored in memory.

TensorFlow, an open-source machine learning platform, has a vulnerability in its `tf.raw_ops.NonMaxSuppressionV5` function that allows attackers to crash applications by supplying a negative number, which causes a division by zero error due to improper type conversion (converting a signed integer to an unsigned integer).

TensorFlow, an open source platform for machine learning, has a vulnerability (CVE-2021-37668) where attackers can crash applications by exploiting the `tf.raw_ops.UnravelIndex` function through division by zero (a math error where a program tries to divide by 0). The bug occurs because the code doesn't check if the `dims` tensor (a multi-dimensional array) is empty before performing calculations.

TensorFlow, an open source machine learning platform, has a vulnerability in its MKL implementation where incomplete validation of input tensor dimensions allows attackers to trigger undefined behavior (accessing invalid memory locations or reading data outside allocated memory bounds). Two operations, requantization and MklRequantizePerChannelOp, are affected by this flaw.

TensorFlow, a machine learning platform, has a vulnerability in its `tf.raw_ops.QuantizeV2` function where incomplete validation (checking that inputs meet requirements) allows attackers to cause crashes or read data from invalid memory locations. The vulnerability occurs because the code doesn't properly verify that input parameters have matching sizes and are within valid ranges.

TensorFlow, an open-source machine learning platform, has a vulnerability where an attacker can create a malicious model file that crashes the system by triggering a null pointer dereference (accessing memory at an invalid location without checking if it's safe). The problem occurs in the MLIR optimization (a compiler technique that improves code performance) of the L2NormalizeReduceAxis operator, which tries to access data in a vector without first verifying the vector contains any elements.