AI & LLM Vulnerabilities

TensorFlow, an open source machine learning platform, had a bug where passing quantized tensors (specially compressed numeric data) to certain functions caused the parsing code to fail silently and return a null pointer (empty reference) instead of the expected data. This could cause crashes or unexpected behavior in machine learning programs using affected TensorFlow functions.

TensorFlow, an open source machine learning platform, has a vulnerability in its `tf.image.generate_bounding_box_proposals` function when running on GPU. The function fails to validate that the `scores` input has the correct rank (dimension structure), which could cause problems. This is classified as improper input validation (CWE-20, where a program doesn't properly check if data meets required specifications).

TensorFlow's poisson loss function (a tool for measuring prediction errors in machine learning) crashes when certain input dimensions multiply together and exceed the limit of a 32-bit integer, causing a size mismatch during broadcast assignment (aligning data for computation). The vulnerability affects multiple versions of TensorFlow.

TensorFlow (an open source platform for machine learning) has a bug in the `tf.raw_ops.ImageProjectiveTransformV2` function where it overflows (uses more memory than available) when given a large output shape. This vulnerability was caused by an incorrect calculation of buffer size (the amount of memory needed to store data).

TensorFlow (an open source machine learning platform) has a vulnerability in the `tf.raw_ops.FusedResizeAndPadConv2D` function where a buffer overflow (a memory error where data exceeds available space) occurs when given very large tensor shapes. The bug stems from an incorrect buffer size calculation.

TensorFlow, an open source machine learning platform, has a bug where creating a numpy array (a data structure for storing numbers) with a specific shape (one dimension with zero elements and others summing to a large number) causes an error. The developers have created a fix and will release it in upcoming versions of TensorFlow.

TensorFlow, an open source machine learning platform, has a vulnerability in the `BaseCandidateSamplerOp` function that causes a heap OOB read (out-of-bounds read, where a program accesses memory it shouldn't) when it receives certain invalid input values. This is a memory safety bug that could allow attackers to read sensitive data from the program's memory.

TensorFlow (an open source platform for machine learning) has a bug where certain operations crash when they receive a different number of inputs than expected, which could cause the program to stop working. This vulnerability is classified as an out-of-bounds read (accessing memory outside the intended range).

Deeplearning4J (a tool for building machine learning models on Java systems) versions up to 1.0.0-M2.1 have a vulnerability where some test code references unclaimed S3 buckets (cloud storage spaces that no longer belong to the original owner), which could potentially be exploited by attackers who claim those buckets. This mainly affects older natural language processing examples in the software.

TensorFlow (an open source platform for machine learning) crashes when converting transposed convolutions (a type of neural network layer operation) with per-channel weight quantization (a compression technique that reduces precision individually for different channels). The crash causes a segfault (a memory access error that terminates the program), crashing the Python process.

TensorFlow, an open source platform for machine learning, has a vulnerability where a function called `Requantize` crashes when given certain types of input data (tensors of nonzero rank), allowing attackers to trigger a denial of service attack (making the system unavailable). The issue has been fixed and will be released in updated versions of the software.

TensorFlow, an open source platform for machine learning, has a bug where a specific function (`tensorflow::full_type::SubstituteFromAttrs`) crashes the program instead of properly reporting an error when it receives incorrect input (a `FullTypeDef` that doesn't have exactly three arguments). This crash could potentially be exploited to make TensorFlow applications stop working.

TensorFlow (an open source platform for machine learning) has a bug where the `RangeSize` function crashes when it receives numbers too large to fit into an `int64_t` (a 64-bit integer data type). This is caused by an integer overflow (when a number becomes too large for its data type to handle).

TensorFlow (an open source machine learning platform) crashes when a specific internal function receives null type list attributes (empty or missing type information). The developers have fixed the bug and will release the patch in upcoming versions of the software.

TensorFlow (an open source platform for machine learning) crashes when a component called mlir::tfg::GraphDefImporter::ConvertNodeDef tries to convert NodeDefs (data structures that define operations) without an operation name. This is a crash vulnerability that could cause the software to stop working unexpectedly.

TensorFlow (an open source platform for machine learning) crashes when a specific internal function called `mlir::tfg::ConvertGenericFunctionToFunctionDef` receives empty function attributes (data describing how a function should behave). This is a reachable assertion vulnerability, meaning the program encounters an unexpected condition it cannot handle.

TensorFlow, an open source machine learning platform, has a bug where a specific function crashes with a null dereference (trying to use a memory address that doesn't exist) when given empty function attributes. The issue affects multiple versions of TensorFlow and has no known workarounds.

TensorFlow, an open source platform for machine learning, has a vulnerability in its `tf.quantization.fake_quant_with_min_max_vars_gradient` function where nonscalar (multi-dimensional) input values for `min` or `max` parameters cause a CHECK fail, which is a crash that could enable a denial of service attack (disrupting service availability). The vulnerability affects multiple supported versions of TensorFlow.

TensorFlow (an open source machine learning platform) has a bug in its `tf.random.gamma` function where large input values can cause a denial of service attack (making the system crash or stop responding). The developers have fixed the issue and will release it in TensorFlow 2.10.0, along with updates to older supported versions.

TensorFlow (an open source machine learning platform) has a vulnerability in its `RandomPoissonV2` function where large input values can cause a CHECK fail (a safety check that stops execution), allowing attackers to trigger a denial of service attack (making the system unavailable). The vulnerability affects multiple versions of TensorFlow.