How to Tackle SaaS Security Misconfigurations

Whether it's Office 365, Salesforce, Slack, GitHub or Zoom, all SaaS apps include a host of security features designed to protect the business and its data. The job of ensuring these apps' security settings are properly configured falls on the security team. The challenge lies within how burdenso...

CVE-2021-34422

The Keybase Client for Windows before version 5.7.0 contains a path traversal vulnerability when checking the name of a file uploaded to a team folder. A malicious user could upload a file to a shared folder with a specially crafted file name which could allow a user to execute an application whi...

Iran's Lyceum Hackers Target Telecoms, ISPs in Israel, Saudi Arabia, and Africa

A state-sponsored threat actor allegedly affiliated with Iran has been linked to a series of targeted attacks aimed at internet service providers ISPs and telecommunication operators in Israel, Morocco, Tunisia, and Saudi Arabia, as well as a ministry of foreign affairs MFA in Africa, new finding...

ChaosDB explained: Azure's Cosmos DB vulnerability walkthrough

This is the full story of the Azure ChaosDB Vulnerability that was discovered and disclosed by the Wiz Research Team, where we were able to gain complete unrestricted access to the databases of several thousand Microsoft Azure customers...

Mozilla Firefox Security Advisory (MFSA2012-58) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Incomplete validation in boosted trees code

Impact The code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service via dereferencing nullptrs or via CHECK-failures as well as abuse undefined behavior binding references to nullptrs. An attacker can also read and write from heap...

Heap OOB read in all `tf.raw_ops.QuantizeAndDequantizeV*` ops

Impact The shape inference functions for the QuantizeAndDequantizeV operations can trigger a read outside of bounds of heap allocated array as illustrated in the following sets of PoCs: python import tensorflow as tf @tf.function def test: data=tf.rawops.QuantizeAndDequantizeV4Grad...

FPE in `ParallelConcat`

Impact The implementation of ParallelConcat misses some input validation and can produce a division by 0: python import tensorflow as tf @tf.function def test: y = tf.rawops.ParallelConcatvalues='tf',shape=0 return y test Patches We have patched the issue in GitHub commit...

Heap OOB read in `tf.raw_ops.SparseCountSparseOutput`

Impact The shape inference functions for SparseCountSparseOutput can trigger a read outside of bounds of heap allocated array: python import tensorflow as tf @tf.function def func: return tf.rawops.SparseCountSparseOutput indices=1, values=1, denseshape=10, weights=, binaryoutput= True func The...

Heap OOB in shape inference for `QuantizeV2`

Impact The shape inference code for QuantizeV2 can trigger a read outside of bounds of heap allocated array: python import tensorflow as tf @tf.function def test: data=tf.rawops.QuantizeV2 input=1.0,1.0, minrange=1.0,10.0, maxrange=1.0,10.0, T=tf.qint32, mode='MINCOMBINED', roundmode='HALFTOEVEN'...

Heap OOB read in `tf.ragged.cross`

Impact The shape inference code for tf.ragged.cross can trigger a read outside of bounds of heap allocated array: python import tensorflow as tf @tf.function def test: y = tf.rawops.RaggedCrossraggedvalues=, raggedrowsplits=, sparseindices=5, sparsevalues=, sparseshape=5, denseinputs='a',...

Deadlock in mutually recursive `tf.function` objects

Impact The code behind tf.function API can be made to deadlock when two tf.function decorated Python functions are mutually recursive: python import tensorflow as tf @tf.function def fun1num: if num == 1: return printnum fun2num-1 @tf.function def fun2num: if num == 0: return printnum fun1num-1...

Reference binding to `nullptr` in `tf.ragged.cross`

Impact The shape inference code for tf.ragged.cross has an undefined behavior due to binding a reference to nullptr. In the following scenario, this results in a crash: python import tensorflow as tf @tf.function def test: y = tf.ragged.crosstf.ragged.constant'1','2' return y test Patches We have...

Null pointer exception in `DeserializeSparse`

Impact The shape inference code for DeserializeSparse can trigger a null pointer dereference: python import tensorflow as tf dataset = tf.data.Dataset.range3 @tf.function def test: y = tf.rawops.DeserializeSparse serializedsparse=tf.data.experimental.tovariantdataset, dtype=tf.int32 test This is...

Null pointer exception when `Exit` node is not preceded by `Enter` op

Impact The process of building the control flow graph for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not: python import tensorflow as tf @tf.function def func: return tf.rawops.Exitdata=False,False func This occurs because the code assumes th...

Integer division by 0 in `tf.raw_ops.AllToAll`

Impact The shape inference code for AllToAll can be made to execute a division by 0: python import tensorflow as tf @tf.function def func: return tf.rawops.AllToAll input=0.0, 0.1652, 0.6543, groupassignment=1, -1, concatdimension=0, splitdimension=0, splitcount=0 func This occurs whenever the...

Undefined behavior via `nullptr` reference binding in sparse matrix multiplication

Impact The code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to nullptr: python import tensorflow as tf tf.rawops.SparseMatMul a=1.0,1.0,1.0, b=,,, transposea=False, transposeb=False, aissparse=False, bissparse=True This occurs whenever the dimensio...

Use after free / memory leak in `CollectiveReduceV2`

Impact The async implementation of CollectiveReduceV2 suffers from a memory leak and a use after free: python import tensorflow as tf tf.rawops.CollectiveReduceV2 input=, groupsize=-10, -10, -10, groupkey=-10, -10, instancekey=-10, orderingtoken=, mergeop='Mul', finalop='Div' This occurs due to t...

Segfault due to negative splits in `SplitV`

Impact The implementation of SplitV can trigger a segfault is an attacker supplies negative arguments: python import tensorflow as tf tf.rawops.SplitV value=tf.constant, sizesplits=-1, -2 ,axis=0, numsplit=2 This occurs whenever sizesplits contains more than one value and at least one value is...

Heap OOB in `FusedBatchNorm` kernels

Impact The implementation of FusedBatchNorm kernels is vulnerable to a heap OOB: python import tensorflow as tf tf.rawops.FusedBatchNormGrad ybackprop=tf.constanti for i in range9,shape=1,1,3,3,dtype=tf.float32 x=tf.constanti for i in range2,shape=1,1,1,2,dtype=tf.float32 scale=1,1,...