AI & LLM Vulnerabilities

TensorFlow (an open-source platform for machine learning) has a vulnerability where an attacker can trigger undefined behavior (unpredictable program crashes or malfunctions) by exploiting the `tf.raw_ops.SparseFillEmptyRows` function, which fails to check whether input arguments are empty tensors (multi-dimensional arrays). This flaw exists in the shape inference code, which is responsible for determining the size and structure of data.

TensorFlow, an open source machine learning platform, has a vulnerability in its Map and OrderedMap operations where an attacker can cause undefined behavior (unpredictable or dangerous program actions) by exploiting a missing check for empty data indices. The code checks if indices are in order but doesn't verify they exist, leaving a gap that can lead to null pointer reference binding (attempting to use memory that hasn't been allocated).

TensorFlow, an open source machine learning platform, has a vulnerability where an attacker can cause undefined behavior (unpredictable program crashes or malfunctions) by exploiting a flaw in the `tf.raw_ops.UnicodeEncode` function. The problem occurs because the code reads data from a tensor without first checking if that tensor is empty, which can lead to a null pointer dereference (trying to access memory that doesn't exist).

TensorFlow, an open source machine learning platform, has a vulnerability (CVE-2021-37666) where attackers can cause undefined behavior (unpredictable program crashes or errors) by exploiting incomplete validation in the RaggedTensorToVariant function. The flaw occurs when the function receives empty input values that it doesn't properly check for.

TensorFlow, a machine learning platform, has a use-after-free vulnerability (a bug where freed memory is accessed again) in the `tf.raw_ops.BoostedTreesCreateEnsemble` function that attackers can trigger with specially crafted input. The issue stems from refactoring that changed a resource from a naked pointer (basic memory reference) to a smart pointer (automatic memory management), causing the resource to be freed twice and its members to be accessed during cleanup after it's already been deallocated.

TensorFlow, a machine learning platform, has a vulnerability in its `SaveV2` function where input validation fails to properly stop execution, allowing an attacker to trigger a null pointer dereference (a crash caused by accessing invalid memory). The validation check uses a method that only sets an error status but doesn't actually stop the function, so harmful operations continue anyway.

TensorFlow (an open-source platform for machine learning) has a vulnerability where an attacker can read data from outside the intended memory area by sending specially crafted invalid arguments to a specific function called `BoostedTreesSparseCalculateBestFeatureSplit`. The problem occurs because the code doesn't properly check that input values are within valid ranges.

TensorFlow, an open-source platform for machine learning, has a vulnerability in two functions (BoostedTreesCalculateBestGainsPerFeature and BoostedTreesCalculateBestFeatureSplitV2) where attackers can cause undefined behavior (unpredictable program crashes or errors) by exploiting missing input validation that fails to check for null references (empty pointers). The issue allows attackers to trigger these crashes through specially crafted inputs.

TensorFlow, an open-source machine learning platform, has a vulnerability where an attacker can cause undefined behavior (unpredictable or unsafe program execution) by exploiting binary cwise operations (element-wise math operations between two arrays) that don't check if their inputs have the same size. This missing check allows the program to read from invalid memory locations and crash or behave unexpectedly.

TensorFlow, a machine learning platform, has a vulnerability in its MatrixSetDiagV operations where an attacker can cause undefined behavior (unpredictable program crashes or errors) by passing an empty tensor (a data structure with no elements) as input, since the code doesn't properly validate that the input tensor has at least one element before trying to access it.

TensorFlow, an open-source machine learning platform, has a vulnerability (CVE-2021-37657) where attackers can cause undefined behavior (unpredictable crashes or errors) by exploiting incomplete validation in matrix diagonal operations. The vulnerability occurs because the code doesn't check if the input tensor (a multi-dimensional array of data) is empty before trying to access its first element.

TensorFlow, a machine learning platform, has a vulnerability where an attacker can cause undefined behavior (unpredictable program crashes or errors) by exploiting incomplete validation in the `tf.raw_ops.RaggedTensorToSparse` function. The function fails to check that split values are in increasing order, allowing an attacker to bind a reference to a null pointer (a reference to an empty memory location).

TensorFlow, an open source platform for machine learning, has a vulnerability where an attacker can read data outside the bounds of allocated memory (a heap buffer overflow) by sending invalid arguments to a specific function called `tf.raw_ops.ResourceScatterUpdate`. The bug exists because the code doesn't properly validate the relationship between the shapes of two inputs called `indices` and `updates`, checking only that their element counts are divisible rather than verifying the correct dimensional relationship needed for broadcasting (automatically expanding smaller arrays to match larger ones).

TensorFlow (an open source platform for machine learning) has a vulnerability in the `tf.raw_ops.ResourceGather` function that allows attackers to crash the software or read data from memory they shouldn't access by supplying an invalid `batch_dims` parameter (a dimension value that exceeds the tensor's rank, which is the number of dimensions in a data structure). The bug occurs because the code doesn't validate that the user's input is within acceptable bounds before using it.

TensorFlow, a machine learning platform, has a vulnerability in the `tf.raw_ops.FractionalAvgPoolGrad` function where it can access memory outside the bounds of allocated buffers (a buffer overflow, where a program reads from memory it shouldn't access) when given an empty input. The function fails to check whether the input is empty before trying to read from it.

TensorFlow, a machine learning platform, has a vulnerability in two functions that can cause a heap buffer overflow (writing data past the end of allocated memory) and crash the program when processing dataset records. The code incorrectly assumes all records are strings without checking, but users might pass numeric types instead, triggering the error.