-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two missing validations in UnbatchGradOp's implementation. The commit 5f945fc explicitly adds: 1) A check that 'id' is scalar by verifying batch_key_t.NumElements() == 1, and 2) A check that batch_index contains 3 elements per batch entry (batch_index_t.NumElements() == batch_index.dim_size(0)*3). These missing preconditions in the original Compute function allowed triggering assertion failures. The test cases in batch_ops_test.py demonstrate exactly these failure scenarios, confirming the vulnerable code path.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.7.2 | 2.7.2 |
| tensorflow | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |
| tensorflow-cpu | pip | < 2.7.2 | 2.7.2 |
| tensorflow-cpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-cpu | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |
| tensorflow-gpu | pip | < 2.7.2 | 2.7.2 |
| tensorflow-gpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-gpu | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |