AI Sec Watch

TensorFlow, an open source platform for machine learning, has a vulnerability where an attacker can cause a heap buffer overflow (a memory corruption bug where data is written beyond the intended memory region) in the Conv2DBackpropFilter function. This happens because the code calculates the filter tensor size but doesn't check that it matches the actual number of elements, leading to memory safety issues when the code later reads or writes to this buffer.

TensorFlow (an open source machine learning platform) has a bug where calling a specific function with certain data types causes a segfault (crash where the program tries to access invalid memory). The function assumes the data will be simple scalars (single values), but fails when given more complex data types like `tf.resource` or `tf.variant`.

TensorFlow, a machine learning platform, has a vulnerability (CVE-2021-29538) where an attacker can cause a division by zero error in the Conv2DBackpropFilter function (a tool for training neural networks) by providing empty tensor shapes, which could crash the system. The bug occurs because the code calculates a divisor from user input without checking if it equals zero before dividing by it.

TensorFlow, a machine learning platform, has a vulnerability where attackers can cause a heap buffer overflow (a memory safety error where data is written past the intended memory boundaries) in the `QuantizedResizeBilinear` function by providing invalid threshold values for quantization (the process of reducing data precision). The bug occurs because the code assumes these inputs are always valid numbers and doesn't properly check them before using them.

TensorFlow, a machine learning platform, has a heap buffer overflow vulnerability (a memory safety bug where code writes beyond allocated memory) in the `QuantizedReshape` function. The vulnerability occurs when an attacker passes empty tensors (multi-dimensional arrays) as threshold inputs, causing the code to incorrectly access memory at position 0 of an empty buffer.

TensorFlow, an open-source machine learning platform, has a vulnerability (CVE-2021-29535) where attackers can cause a heap buffer overflow (a memory safety error where code writes beyond allocated memory) in the `QuantizedMul` function by providing invalid threshold values for quantization. The bug occurs because the code assumes input values are always valid and tries to access data that doesn't exist when empty tensors (multi-dimensional arrays) are passed in.

TensorFlow, an open source machine learning platform, has a vulnerability where an attacker can crash the program through a denial of service attack by sending specially crafted input to the `SparseConcat` function. The problem occurs because the code uses a `CHECK` operation (a safety check that crashes the program if something goes wrong) instead of safer error-handling methods like `BuildTensorShapeBase` or `AddDimWithStatus`.

TensorFlow has a vulnerability (CVE-2021-29533) where an attacker can crash the application by sending an empty image to the `tf.raw_ops.DrawBoundingBoxes` function. The bug exists because the code uses `CHECK` assertions (which crash the program on failure) instead of `OP_REQUIRES` (which returns an error message to the user) to validate user input, causing the program to abort when it receives invalid data.

TensorFlow, an open-source machine learning platform, has a vulnerability in the `tf.raw_ops.RaggedCross` function that allows attackers to access memory outside the intended boundaries of arrays (heap OOB reads, meaning out-of-bounds reads in heap memory) by sending specially crafted invalid tensor values. The problem occurs because the code doesn't validate user-supplied arguments before using them to access array elements.