AI & LLM Vulnerabilities

A vulnerability in TensorFlow (an open-source machine learning framework) allows attackers to cause a denial of service (making a service unavailable) by modifying a SavedModel (a serialized TensorFlow model) so that the TensorByteSize function crashes. The problem occurs because the TensorShape constructor crashes when it encounters partial shapes (incomplete dimension information) or very large numbers, instead of gracefully handling them like PartialTensorShape does.

A vulnerability in TensorFlow (an open source machine learning framework) exists in the Grappler optimizer, which can be exploited to cause a denial of service (making a system unavailable by overloading it) by modifying a SavedModel file so that a function called IsSimplifiableReshape triggers CHECK failures (unexpected error conditions that crash the program).

TensorFlow, an open-source machine learning framework, has a vulnerability in its shape inference process where it can allocate a large vector based on user-controlled input, potentially causing uncontrolled resource consumption (using excessive memory or CPU). This happens because the system doesn't properly validate the size of data requested by users.

TensorFlow (an open source machine learning framework) has a vulnerability in its Grappler optimizer (a tool that improves how machine learning models run) that allows attackers to cause a denial of service (making the system stop working) by modifying a SavedModel (a saved machine learning model) in a way that triggers crashes. This vulnerability affects multiple versions of TensorFlow.

TensorFlow (an open-source machine learning framework) has a memory leak bug in a function called `ImmutableExecutorState::Initialize`. When a graph node (a processing unit in a machine learning model) is invalid, the software sets a pointer (a reference to a location in memory) to null without freeing the memory it previously pointed to, causing that memory to be wasted and unavailable for other tasks.

TensorFlow, an open source machine learning framework, has a vulnerability in the `GetInitOp` function that can crash the software through a null pointer dereference (accessing memory that doesn't exist). The vulnerability affects multiple versions of TensorFlow.

TensorFlow (an open-source machine learning framework) has a vulnerability in its `OpLevelCostEstimator::CalculateOutputSize` function where an integer overflow (when a calculation produces a number too large for the system to handle) can occur if an attacker creates an operation with tensors (multi-dimensional arrays of numbers) containing enough elements. The vulnerability can be triggered either by using many dimensions or by making individual dimensions large enough to cause the overflow.

TensorFlow, an open-source machine learning framework, has a vulnerability in its `OpLevelCostEstimator::CalculateTensorSize` function that can be exploited through integer overflow (a type of bug where numbers become too large for the program to handle correctly). An attacker could trigger this by creating an operation with a tensor (a multi-dimensional array of data) containing an extremely large number of elements.

TensorFlow (an open source machine learning framework) has a bug where it sometimes fails to determine data types correctly during shape inference (the process of figuring out what dimensions data will have). The bug is hidden in production builds because assertion checks are disabled, causing the program to crash when it tries to use an error result as if it were valid data.

TensorFlow (an open source machine learning framework) has a vulnerability where attackers can crash TensorFlow processes by sending specially crafted data with invalid tensor types or shapes during decoding from protobuf (a data format used to serialize structured data). This is a denial of service attack, meaning the attacker can make the system stop working rather than gain unauthorized access.

TensorFlow, an open-source machine learning framework, has a bug where it can crash or behave unpredictably when decoding certain data structures (protobuf, a format for storing structured data) if some required information is missing. The problem occurs because the code only checks for this issue in debug builds (test versions), not in production builds (versions used in real applications), so real users may experience crashes or undefined behavior.

TensorFlow (an open-source machine learning framework) has a vulnerability where an attacker can crash the system by modifying a SavedModel file on disk to contain duplicate operation attributes, triggering an assertion failure (a built-in check that causes the program to stop if a condition is false). This is a denial of service attack (making a system unavailable to legitimate users).

TensorFlow (an open source machine learning framework) has a vulnerability where attackers can crash TensorFlow processes by providing specially crafted input when the system converts protobuf (a data format) into resource handle tensors, because a validation check can be bypassed through user-controlled arguments.