CVE-2022-29203: 
Python vulnerability analysis and mitigation

TensorFlow's implementation of tf.raw_ops.SpaceToBatchND (in all backends such as XLA and handwritten kernels) was found to be vulnerable to an integer overflow prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4. The vulnerability was discovered and disclosed in May 2022, affecting the TensorFlow machine learning platform (GitHub Advisory).

The vulnerability occurs when the result of an integer overflow is used to allocate the output tensor, leading to a denial of service through a CHECK-failure (assertion failure). The issue affects all backends including XLA and handwritten kernels. The vulnerability has been assigned a High severity rating (GitHub Advisory).

When exploited, this vulnerability results in a denial of service via a CHECK-failure (assertion failure). The integer overflow affects the allocation of output tensors, which can cause the application to crash (GitHub Advisory).

The vulnerability can be triggered by providing specific inputs to the tf.raw_ops.SpaceToBatchND operation. A proof of concept includes using a constant input of -3.5e+35 with shape [10,19,22] in float32 format, along with a block_shape constant of -1879048192 (GitHub Advisory).

The vulnerability has been patched in TensorFlow versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4. The fix was implemented through GitHub commit acd56b8bcb72b163c834ae4f18469047b001fadf. Users are advised to upgrade to one of these patched versions to mitigate the vulnerability (GitHub Advisory, TF Release).