-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the unvalidated 'size' input in TensorListResize::Compute. The commit diff shows the fix adds OP_REQUIRES(c, TensorShapeUtils::IsScalar(...)) to validate() scalar input. The original code path would proceed to read a scalar value from potentially non-scalar input tensors, leading to assertion failures. The test case provided in the description specifically exercises this path with a rank-4 numpy array for 'size', which would trigger the CHECK failure in unpatched versions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.8.4 | 2.8.4 |
| tensorflow | pip | >= 2.9.0, < 2.9.3 | 2.9.3 |
| tensorflow | pip | >= 2.10.0, < 2.10.1 | 2.10.1 |
| tensorflow-cpu | pip | < 2.8.4 | 2.8.4 |
| tensorflow-gpu | pip | < 2.8.4 | 2.8.4 |
| tensorflow-cpu | pip | >= 2.9.0, < 2.9.3 | 2.9.3 |
| tensorflow-gpu | pip | >= 2.9.0, < 2.9.3 | 2.9.3 |
| tensorflow-cpu | pip | >= 2.10.0, < 2.10.1 | 2.10.1 |
| tensorflow-gpu | pip | >= 2.10.0, < 2.10.1 | 2.10.1 |
A Semantic Attack on Google Gemini - Read the Latest Research