-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing rank validation in LSTMBlockCellOp's Compute implementation. The commit diff shows 15 added OP_REQUIRES statements validating tensor ranks, which were absent in vulnerable versions. The Python PoC demonstrates passing tensors with incorrect ranks (e.g., wco with shape [28,17] instead of rank 1), which would crash unpatched versions. The function is explicitly mentioned in CVE-2022-29200's impact section and the patch directly addresses it by adding validation logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.6.4 | 2.6.4 |
| tensorflow | pip | >= 2.7.0, < 2.7.2 | 2.7.2 |
| tensorflow | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-cpu | pip | < 2.6.4 | 2.6.4 |
| tensorflow-cpu | pip | >= 2.7.0, < 2.7.2 | 2.7.2 |
| tensorflow-cpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-gpu | pip | < 2.6.4 | 2.6.4 |
| tensorflow-gpu | pip | >= 2.7.0, < 2.7.2 | 2.7.2 |
| tensorflow-gpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |