-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from QuantizedAddOp's Compute method not validating that min_x/max_x/min_y/max_y inputs are scalar tensors (rank 0). The pre-patch code accessed these tensors via .flat<float>()(0) without rank checks, which would crash if given higher-rank tensors. The commit 49b3824 explicitly adds TensorShapeUtils::IsScalar checks to enforce scalar inputs, confirming this was the root cause. The CVE description and PoC specifically target QuantizedAdd, and the diff shows the vulnerability was in this function's input handling.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.7.2 | 2.7.2 |
| tensorflow | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |
| tensorflow-cpu | pip | < 2.7.2 | 2.7.2 |
| tensorflow-cpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-cpu | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |
| tensorflow-gpu | pip | < 2.7.2 | 2.7.2 |
| tensorflow-gpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-gpu | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |