AI Sec Watch

TensorFlow is a machine learning platform that had a vulnerability where an attacker could crash the system by sending invalid arguments to the `tf.strings.substr` function, which performs string operations. This vulnerability was caused by improper error handling (not properly catching and managing exceptional conditions that shouldn't happen).

TensorFlow, a machine learning platform, has a vulnerability where TrySimplify (a code optimization component) can crash by dereferencing a null pointer (trying to access memory that doesn't exist) when optimizing nodes with no inputs. This undefined behavior can cause the program to fail unexpectedly.

A vulnerability in TensorFlow (an open source machine learning platform) allows attackers to cause a stack overflow (a crash caused by a program using too much memory on the call stack) by sending specially crafted input to the `ParseAttrValue` function through recursion (when a function calls itself repeatedly).

A bug in TensorFlow's `tf.io.decode_raw` function causes incorrect results and crashes when using certain combinations of parameters. The problem stems from incorrect pointer arithmetic (moving through memory incorrectly), which causes the function to skip parts of input data and write outside the allocated memory bounds (OOB write, where data is written to memory locations it shouldn't access), potentially leading to crashes or more serious attacks.

TensorFlow (an open-source machine learning platform) has a vulnerability in its `tf.raw_ops.CTCLoss` function where incomplete validation (insufficient checking of input data) allows an attacker to trigger an OOB read from heap (accessing memory outside the intended boundaries). This is a memory safety issue that could crash the program or expose sensitive data.

TensorFlow has a vulnerability (CVE-2021-29612) where a specific operation called `tf.raw_ops.BandedTriangularSolve` can be tricked into accessing memory it shouldn't (a heap buffer overflow, where an attacker reads or writes beyond the intended memory boundaries). The bug happens because the code doesn't properly check if input data is empty, and it doesn't verify that earlier validation checks actually succeeded before continuing to process the data.

TensorFlow, an open-source machine learning platform, has a vulnerability in the `SparseReshape` function where it doesn't properly check that input arguments are valid before using them. This incomplete validation allows an attacker to cause a denial of service (a crash that makes the system unavailable) by triggering a CHECK-failure, which is a built-in safety check that stops execution when something goes wrong.

TensorFlow has a vulnerability in the `QuantizeAndDequantizeV2` function where incorrect validation of the `axis` parameter allows invalid values to pass through, potentially causing heap underflow (a memory safety error where data is accessed below allocated memory boundaries). This flaw could let attackers read or write to other data stored in the heap (the area of memory used for dynamic storage).

TensorFlow's `SparseAdd` function (a tool for adding sparse tensors, which are data structures with mostly empty values) has incomplete validation that allows attackers to cause undefined behavior like accessing null memory or writing data outside allocated memory bounds. The vulnerability exists because the code doesn't properly check if tensors are empty or if their dimensions match, letting attackers send invalid sparse tensors that exploit unprotected assumptions.