AI Sec Watch

CVE-2022-29206 is a bug in TensorFlow (an open source machine learning platform) where a specific function called `tf.raw_ops.SparseTensorDenseAdd` doesn't properly check its input arguments, causing a nullptr (a reference pointing to nothing) to be accessed during execution, which leads to undefined behavior. This vulnerability affects TensorFlow versions before 2.9.0, 2.8.1, 2.7.2, and 2.6.4.

TensorFlow (an open-source machine learning platform) has a bug in older versions where calling certain compatibility functions with unsupported data types causes the program to crash. When the code tries to process a missing function, it attempts to use a null pointer (a reference to nothing in memory), which causes a segmentation fault (a type of crash where the program accesses memory it shouldn't).

TensorFlow, an open source platform for machine learning, has a vulnerability in one of its operations called `tf.raw_ops.UnsortedSegmentJoin` where it doesn't properly check its inputs before using them. If someone provides a negative number where a positive one is expected, it causes the program to crash with an assertion failure, which is a type of denial of service attack (making software unavailable by crashing it).

CVE-2022-29203 is a vulnerability in TensorFlow (an open source platform for machine learning) where a function called `tf.raw_ops.SpaceToBatchND` has an integer overflow bug (a situation where a calculation produces a number too large for the system to handle). This overflow causes a denial of service (making the system crash or become unavailable) when the buggy code tries to allocate memory for output data.

A vulnerability in TensorFlow (an open source platform for machine learning) versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4 allows attackers to cause a denial of service (making a system unavailable by consuming all available memory) by exploiting the `tf.ragged.constant` function, which does not properly check its input arguments. The vulnerability exists because of improper input validation (checking that data meets expected requirements before using it).

TensorFlow, an open source machine learning platform, had a vulnerability in its `tf.raw_ops.QuantizedConv2D` function (a tool for processing images with reduced precision) before versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 where it did not properly check input arguments, causing references to point to nullptr (an invalid memory location). This flaw was fixed in the mentioned versions.

TensorFlow (an open source platform for machine learning) has a vulnerability in versions before 2.9.0, 2.8.1, 2.7.2, and 2.6.4 where certain operations fail when given an invalid resource handle (a reference to data or tools the program needs). In eager mode (where TensorFlow executes code immediately rather than preparing a plan first), this can cause a reference to point to a null pointer (a memory location that doesn't exist), leading to undefined behavior and potential crashes or errors. Graph mode had safeguards that prevented this issue.

TensorFlow (an open-source machine learning platform) has a bug in the `tf.raw_ops.LSTMBlockCell` function where it doesn't properly check that input arguments have the correct structure. An attacker can exploit this to cause a denial of service attack (crashing the program), because the code fails when trying to access elements inside incorrectly-shaped inputs.

TensorFlow (an open source machine learning platform) had a bug in the `tf.raw_ops.LoadAndRemapMatrix` function that didn't properly check its input arguments, specifically whether the `initializing_values` parameter was valid. This missing validation could cause the program to crash (denial of service, a type of attack that makes a service unavailable), even though the attacker doesn't gain control of the system.