-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from integer overflow in broadcast dimension calculations. The commit diff shows critical changes in cwise_ops_common.h where dimension indices were changed from int to Eigen::DenseIndex (wider type). The original implementations of NByOne and OneByM used int parameters for dimension sizes, which could overflow when handling large tensors (e.g., 50,000x50,000 -> 2.5e9 elements). This overflow would cause incorrect broadcast shape calculations, leading to size mismatch crashes. The patched version explicitly uses Eigen::DenseIndex to prevent this overflow.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.9.3 | 2.9.3 |
| tensorflow | pip | >= 2.10.0, < 2.10.1 | 2.10.1 |
| tensorflow-cpu | pip | < 2.9.3 | 2.9.3 |
| tensorflow-gpu | pip | < 2.9.3 | 2.9.3 |
| tensorflow-cpu | pip | >= 2.10.0, < 2.10.1 | 2.10.1 |
| tensorflow-gpu | pip | >= 2.10.0, < 2.10.1 | 2.10.1 |
Ongoing coverage of React2Shell