-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| paddlepaddle | pip | < 2.4 | 2.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing bounds checks in both CPU and GPU implementations of gather_tree operations. The patch adds PADDLE_ENFORCE checks to validate parent indices against beam_size, which were previously absent. The kernel code directly used parent indices to access memory without validation, making these functions the root cause. The Python wrapper's dimension checks (added in the patch) address input validation but the core OOB read occurred in the C++/CUDA kernels.