Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Reference binding to nullptr in boosted trees in TensorFlow
Vulnerability Description
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can generate undefined behavior via a reference binding to nullptr in `BoostedTreesCalculateBestGainsPerFeature` and similar attack can occur in `BoostedTreesCalculateBestFeatureSplitV2`. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/stats_ops.cc) does not validate the input values. We have patched the issue in GitHub commit 9c87c32c710d0b5b53dc6fd3bfde4046e1f7a5ad and in commit 429f009d2b2c09028647dd4bb7b3f6f414bbaad7. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Vulnerability Type
使用未经初始化的指针
Vulnerability Title
Google TensorFlow 缓冲区错误漏洞
Vulnerability Description
Google TensorFlow是美国谷歌（Google）公司的一套用于机器学习的端到端开源平台。 Google TensorFlow 存在缓冲区错误漏洞，攻击者可以通过引用绑定到"BoostedTreesCalculateBestGainsPerFeature"中的nullptr来生成未定义的行为，类似的攻击可能会发生在"BoostedTreesCalculateBestFeatureSplitV2"中。以下产品及版本收到影响：TensorFlow 2.5.1、TensorFlow 2.4.3 和 T
CVSS Information
N/A
Vulnerability Type
N/A