AI & LLM Vulnerabilities

A vulnerability in TensorFlow (an open source machine learning platform) allows attackers to cause a stack overflow (a crash caused by a program using too much memory on the call stack) by sending specially crafted input to the `ParseAttrValue` function through recursion (when a function calls itself repeatedly).

TensorFlow has a vulnerability (CVE-2021-29612) where a specific operation called `tf.raw_ops.BandedTriangularSolve` can be tricked into accessing memory it shouldn't (a heap buffer overflow, where an attacker reads or writes beyond the intended memory boundaries). The bug happens because the code doesn't properly check if input data is empty, and it doesn't verify that earlier validation checks actually succeeded before continuing to process the data.

TensorFlow, an open-source machine learning platform, has a vulnerability in the `SparseReshape` function where it doesn't properly check that input arguments are valid before using them. This incomplete validation allows an attacker to cause a denial of service (a crash that makes the system unavailable) by triggering a CHECK-failure, which is a built-in safety check that stops execution when something goes wrong.

TensorFlow has a vulnerability in the `QuantizeAndDequantizeV2` function where incorrect validation of the `axis` parameter allows invalid values to pass through, potentially causing heap underflow (a memory safety error where data is accessed below allocated memory boundaries). This flaw could let attackers read or write to other data stored in the heap (the area of memory used for dynamic storage).

TensorFlow, an open source machine learning platform, has a vulnerability in its TFLite (TensorFlow Lite, a lightweight version for mobile devices) hashtable lookup implementation that can cause a division by zero error (a crash caused by dividing by zero). An attacker could create a malicious model that triggers this crash by setting a dimension to 0.

TensorFlow, a machine learning platform, has a vulnerability where a specially crafted TFLite model (a lightweight version of TensorFlow for mobile devices) can cause an OOB write on heap (writing data beyond allocated memory boundaries) in the ArgMin/ArgMax operations. The bug occurs when the axis_value parameter falls outside valid bounds, causing the code to write past the end of the output array.

TensorFlow, an open-source machine learning platform, has a vulnerability in its `DepthwiseConv` operator (a component that performs a specific type of mathematical operation on data) where an attacker could craft a malicious model that causes a division by zero error (trying to divide a number by zero, which crashes the program). This allows an attacker to potentially crash or disrupt systems using this component.

TensorFlow's `OneHot` operator (a component that converts index values into one-hot encoded vectors) in TFLite, the lightweight version for mobile devices, has a division by zero vulnerability. An attacker could create a malicious model that causes the operator to divide by zero, potentially crashing the system or causing unexpected behavior.

TensorFlow, an open source platform for machine learning, has a vulnerability in its `Split` operator for TFLite (TensorFlow Lite, a lightweight version for mobile devices) that causes a division by zero error (a crash that happens when code tries to divide a number by zero). An attacker can create a malicious model that sets `num_splits` to 0, triggering this crash.

TensorFlow, an open-source machine learning platform, has a vulnerability in its SVDF TFLite operator (a component that performs specific neural network calculations on mobile devices) where an attacker can craft a malicious model that causes a division by zero error (attempting to divide a number by zero, which crashes the program). This happens when a parameter called `params->rank` is set to 0.

TensorFlow, an open-source machine learning platform, has a vulnerability in its `SpaceToBatchNd` operator (a function that rearranges data in neural network models) that can be triggered by a division by zero error (when code tries to divide a number by zero, crashing the system). An attacker can create a malicious model that causes this crash by setting one dimension of the block input to 0.

TensorFlow, an open source machine learning platform, has a vulnerability in its `EmbeddingLookup` operator that can cause a division by zero error (a crash caused by trying to divide by zero). An attacker could craft a malicious model with a specific input dimension set to 0 to trigger this crash.