Python| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.7.2 | 2.7.2 |
| tensorflow | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |
| tensorflow-cpu | pip | < 2.7.2 | 2.7.2 |
| tensorflow-cpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-cpu | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |
| tensorflow-gpu | pip | < 2.7.2 | 2.7.2 |
| tensorflow-gpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-gpu | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing rank validation in the RaggedTensorToVariant operation implementation. The commit diff shows the patch added explicit rank checks (OP_REQUIRES(context, ...dims() == 1)) in the C++ kernel implementation. The vulnerable versions lacked these checks, allowing tensors with !=1 rank to trigger assertion failures. The Python test cases demonstrate this by passing invalid splits, but the core vulnerability resides in the C++ Compute method handling the operation logic.
KEV Misses 88% of Exploited CVEs- Get the report
