-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.6.4 | 2.6.4 |
| tensorflow | pip | >= 2.7.0, < 2.7.2 | 2.7.2 |
| tensorflow | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-cpu | pip | < 2.6.4 | 2.6.4 |
| tensorflow-cpu | pip | >= 2.7.0, < 2.7.2 | 2.7.2 |
| tensorflow-cpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-gpu | pip | < 2.6.4 | 2.6.4 |
| tensorflow-gpu | pip | >= 2.7.0, < 2.7.2 | 2.7.2 |
| tensorflow-gpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from improper use of QuantizeMultiplierSmallerThanOneExp in quantization paths. The commit a989426 explicitly replaced these calls with a new QuantizeMultiplier wrapper that checks scale magnitude, confirming the original functions were vulnerable. The crash stacktrace in GitHub issue #43661 shows QuantizeMultiplierSmallerThanOneExp in the abort path, and the CVE description explicitly identifies this function as the trigger.