AI Sec Watch

TensorFlow, an open source machine learning platform, has a vulnerability in its MKL implementation where incomplete validation of input tensor dimensions allows attackers to trigger undefined behavior (accessing invalid memory locations or reading data outside allocated memory bounds). Two operations, requantization and MklRequantizePerChannelOp, are affected by this flaw.

TensorFlow, a machine learning platform, has a vulnerability in its `tf.raw_ops.QuantizeV2` function where incomplete validation (checking that inputs meet requirements) allows attackers to cause crashes or read data from invalid memory locations. The vulnerability occurs because the code doesn't properly verify that input parameters have matching sizes and are within valid ranges.

TensorFlow, an open-source machine learning platform, has a vulnerability where an attacker can create a malicious model file that crashes the system by triggering a null pointer dereference (accessing memory at an invalid location without checking if it's safe). The problem occurs in the MLIR optimization (a compiler technique that improves code performance) of the L2NormalizeReduceAxis operator, which tries to access data in a vector without first verifying the vector contains any elements.

TensorFlow, an open source machine learning platform, has a vulnerability where an attacker can create a specially crafted TFLite model (a lightweight version of TensorFlow for mobile devices) that causes a null pointer dereference (attempting to access memory that doesn't exist), crashing the system and preventing it from working. The flaw occurs because the code tries to access a pointer without checking if it's valid first.

TensorFlow 2.6.0 has a bug in its strided slice implementation (a feature that extracts portions of arrays), which attackers can exploit to create models that cause infinite loops (the program gets stuck repeating the same instructions endlessly). The bug appears in TFLite (TensorFlow Lite, a lightweight version for mobile devices) when handling ellipsis (a shorthand notation using '...' in array indexing).

TensorFlow (an open source machine learning platform) has a vulnerability in its SVDF implementation (a neural network component) in TFLite (a lightweight version for mobile devices) where a null pointer error (attempting to use data that doesn't exist in memory) can occur. The bug happens because the `GetVariableInput` function can return a null pointer, but the code doesn't check for this before trying to use it as valid data.

TensorFlow, an open source machine learning platform, has a vulnerability in its fully connected layers (neural network components that connect all inputs to all outputs) in TFLite (a lightweight version for mobile devices) that causes a division by zero error (attempting to divide by zero, which crashes the program). The issue has been patched and will be included in upcoming updates.

TensorFlow (an open-source platform for machine learning) has a vulnerability where an attacker can trigger undefined behavior (unpredictable program crashes or malfunctions) by exploiting the `tf.raw_ops.SparseFillEmptyRows` function, which fails to check whether input arguments are empty tensors (multi-dimensional arrays). This flaw exists in the shape inference code, which is responsible for determining the size and structure of data.

TensorFlow, a machine learning platform, has a vulnerability where attackers can crash the software by exploiting division by zero errors in convolution operators (mathematical operations that process data in machine learning models). This happens because the code that checks input shapes is missing validation steps before performing divisions, allowing someone to trigger a denial of service (making the system unavailable).