Browse All

TensorFlow, an open-source machine learning framework, has a typo in its `SpecializeType` code that causes a heap OOB (out-of-bounds, where the program tries to read or write memory outside the area it's allowed to access) read/write vulnerability. Due to the typo, a variable called `arg` uses the wrong loop index, which allows code to read and modify data outside the intended memory bounds.

TensorFlow's `AssignOp` (a copy operation in machine learning code) has a bug where it can copy uninitialized data (memory with random or leftover values) to a new tensor, causing unpredictable behavior. The code only checks that the destination is ready, but not the source, leaving room for uninitialized data to be used.

TensorFlow, an open-source machine learning framework, has a vulnerability in its Grappler component where the `set_output` function can write data to an array at any index specified by an attacker, creating a heap OOB write (out-of-bounds write, where data is written to memory locations it shouldn't access). This gives a malicious user the ability to write arbitrary data to unintended memory locations.

TensorFlow, an open-source machine learning framework, uses an unsafe function called `tempfile.mktemp` to create temporary files in multiple places. This creates a race condition vulnerability (TOC/TOU, a timing gap where another process can interfere between when the system checks if a filename exists and when it actually creates the file), which is especially dangerous in utility and library code rather than just testing code.

TensorFlow (an open-source framework for building machine learning models) has a vulnerability in its Range function where integer overflows (when numbers get too large and wrap around to incorrect values) can cause undefined behavior or extremely large memory allocations. This bug affects multiple versions of the software.

An attacker can create a malicious TFLite model (a compressed machine learning format for mobile devices) that writes data outside the boundaries of an array in TensorFlow, potentially overwriting the memory allocator's linked list (a data structure that tracks available memory) to achieve arbitrary write access to system memory. This vulnerability affects multiple versions of TensorFlow, an open-source framework for building AI systems.

TensorFlow, an open-source machine learning framework, has a vulnerability in TFLite (TensorFlow Lite, a lightweight version for mobile devices) where an attacker can create a specially crafted model that allows limited reads and writes outside of arrays by exploiting missing validation during conversion from sparse tensors (data structures with mostly empty values) to dense tensors (fully populated data structures). This vulnerability affects multiple versions of TensorFlow.

TensorFlow (an open-source machine learning framework) has a vulnerability where an attacker can create a malicious TFLite model (a lightweight version of TensorFlow for mobile devices) that causes an integer overflow (when a number calculation exceeds the maximum value a computer can store) in embedding lookup operations. This overflow can sometimes lead to heap OOB read/write (accessing memory outside the intended boundaries), potentially allowing attackers to read or corrupt data.

An attacker can create a malicious TFLite model (a lightweight version of TensorFlow used on mobile devices) that causes an integer overflow (where a number gets too large to fit in its storage space, wrapping around to a negative or small value) in TensorFlow's `TfLiteIntArrayCreate` function. The vulnerability happens because the code returns an `int` instead of a larger `size_t` datatype, allowing attackers to manipulate model inputs so the calculated size exceeds what an `int` can hold.

TensorFlow, an open-source machine learning framework, has a vulnerability in its `SparseCountSparseOutput` function that allows a heap overflow (a type of memory corruption where a program writes data beyond allocated memory boundaries). The vulnerability affects multiple versions of TensorFlow.