-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing bounds checking in FractionalMaxPoolGradOp's Compute method. The commit d71090c added a critical OP_REQUIRES check to validate() pooling sequence sizes against input tensor dimensions. The vulnerable code path existed in the gradient computation where invalid pooling sequences could trigger out-of-bounds memory accesses during the pooling region iteration. The function's direct manipulation of tensor indices without proper input validation matches the described heap OOB read vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.8.4 | 2.8.4 |
| tensorflow | pip | >= 2.9.0, < 2.9.3 | 2.9.3 |
| tensorflow | pip | >= 2.10.0, < 2.10.1 | 2.10.1 |
| tensorflow-cpu | pip | < 2.8.4 | 2.8.4 |
| tensorflow-gpu | pip | < 2.8.4 | 2.8.4 |
| tensorflow-cpu | pip | >= 2.9.0, < 2.9.3 | 2.9.3 |
| tensorflow-gpu | pip | >= 2.9.0, < 2.9.3 | 2.9.3 |
| tensorflow-cpu | pip | >= 2.10.0, < 2.10.1 | 2.10.1 |
| tensorflow-gpu | pip | >= 2.10.0, < 2.10.1 | 2.10.1 |
A Semantic Attack on Google Gemini - Read the Latest Research