-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.7.2 | 2.7.2 |
| tensorflow | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |
| tensorflow-cpu | pip | < 2.7.2 | 2.7.2 |
| tensorflow-cpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-cpu | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |
| tensorflow-gpu | pip | < 2.7.2 | 2.7.2 |
| tensorflow-gpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-gpu | pip | >= 2.9.0, < 2.9.1 | 2.9.1 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of quantization dimensions in MLIR passes during TFLite conversion. The commit diff shows critical fixes in ResetAxisAndBroadcast (incorrect reshape dimension logic) and CastQuantizedTypeAttrFromExpressedType (missing axis validation). These functions directly process per-channel quantization parameters and shape transformations for transposed convolutions. The segfault occurred when the converter tried to use an invalid quantization axis derived from these flawed calculations, consistent with CWE-20 (input validation failure). The high confidence comes from the direct correlation between the patched logic and the described crash scenario.
Ongoing coverage of React2Shell