CVE-2022-21733: 
Python vulnerability analysis and mitigation

The CVE-2022-21733 vulnerability affects TensorFlow, an Open Source Machine Learning Framework. The vulnerability was discovered in the implementation of StringNGrams and was disclosed on February 2, 2022. The issue affects TensorFlow versions prior to 2.8.0, with patched versions including 2.5.3, 2.6.3, and 2.7.1 (TF Advisory).

The vulnerability stems from missing validation on the padwidth parameter in the StringNGrams implementation. This oversight can result in computing a negative value for ngramwidth, which is later used for output allocation. The issue can lead to an integer overflow condition (TF Advisory).

When exploited, this vulnerability can trigger a denial of service attack by causing an Out of Memory (OOM) condition after an integer overflow occurs. This can affect the availability of systems running vulnerable versions of TensorFlow (TF Advisory).

The issue has been patched in GitHub commit f68fdab93fb7f4ddb4eb438c8fe052753c9413e8 and included in TensorFlow version 2.8.0. The fix was also backported to versions 2.7.1, 2.6.3, and 2.5.3. Users should upgrade to these patched versions to mitigate the vulnerability (TF Advisory).

The vulnerability was reported by Yu Tian of Qihoo 360 AIVul Team and was rated as having a Moderate severity impact (TF Advisory).