CVE-2022-29196: 
Python vulnerability analysis and mitigation

TensorFlow's implementation of tf.raw_ops.Conv3DBackpropFilterV2 contained a vulnerability (CVE-2022-29196) prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4. The vulnerability was discovered in April 2022 by Neophytos Christou from Secure Systems Lab at Brown University (GitHub Advisory).

The vulnerability stems from insufficient input validation in the tf.raw_ops.Conv3DBackpropFilterV2 implementation. Specifically, the code fails to validate that the filter_sizes argument is a vector, which can lead to a CHECK-failure when non-vector inputs are provided (GitHub Advisory).

When exploited, this vulnerability can trigger a denial of service attack through a CHECK-failure. The attack can be executed by providing a non-vector input for the filter_sizes parameter (GitHub Advisory).

The vulnerability has been patched in TensorFlow versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4. The fix was implemented through GitHub commit 174c5096f303d5be7ed2ca2662b08371bff4ab88, which adds proper validation for the filter_sizes argument. Users are advised to upgrade to one of these patched versions (GitHub Advisory).