-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.7.2 | 2.7.2 |
| tensorflow | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |
| tensorflow-cpu | pip | < 2.7.2 | 2.7.2 |
| tensorflow-cpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-cpu | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |
| tensorflow-gpu | pip | < 2.7.2 | 2.7.2 |
| tensorflow-gpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-gpu | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing validation checks for empty edge names in two key areas: 1) When processing function return values (ret) and control returns (control_ret) in ImportGenericFunction, empty ret_val.second values would cause invalid placeholder creation. 2) In ImportNodes, empty node input strings would lead to invalid operations. The patch added explicit checks (ret_val.second.empty() and input.empty()) in these locations, confirming these were the vulnerable code paths. Both functions are in functiondef_import.cc and directly handle the edge name processing that caused the crash.