-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.7.2 | 2.7.2 |
| tensorflow | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow | pip | >= 2.9.0, < 2.9.1 | 2.9.2 |
| tensorflow-cpu | pip | < 2.7.2 | 2.7.2 |
| tensorflow-cpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-cpu | pip | >= 2.9.0, < 2.9.1 | 2.9.2 |
| tensorflow-gpu | pip | < 2.7.2 | 2.7.2 |
| tensorflow-gpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-gpu | pip | >= 2.9.0, < 2.9.1 | 2.9.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing validation when constructing TensorShapes in AvgPool gradient operations. The commit 3a6ac52 shows critical fixes replacing TensorShape::AddDim with AddDimWithStatus + OP_REQUIRES_OK in three AvgPoolingGradOp::Compute implementations. This indicates the original code lacked proper error checking for tensor dimensions, allowing negative ksize values (via integer overflow from large values like 1e20) to trigger CHECK failures. While the CVE title mentions AvgPoolOp, the technical analysis shows the actual vulnerable code paths were in the gradient computations (AvgPoolGrad), where invalid tensor dimensions were not properly validated before shape construction.