CVE-2022-35940: 
Python vulnerability analysis and mitigation

CVE-2022-35940 is a low severity vulnerability affecting TensorFlow versions prior to 2.10.0, discovered in September 2022. The vulnerability exists in the RaggedRangeOp function where an integer overflow can occur when converting large float values to int64, potentially causing program crashes (GitHub Advisory).

The vulnerability occurs in the RaggedRangeOp function when processing the 'limits' argument. When a very large float value is provided as input, the conversion to int64 for constructing a TensorShape can trigger an integer overflow. While this results in an InvalidArgument error, it also causes an abort signal that crashes the program. The issue was fixed in commit 37cefa91bee4eace55715eeef43720b958a01192 by adding proper overflow checks (GitHub Advisory).

When exploited, this vulnerability can cause program crashes through an abort signal, even though it triggers an InvalidArgument error. The impact is considered low severity as it primarily affects program stability rather than security (GitHub Advisory).

The vulnerability can be triggered by providing specific input values to the RaggedRangeOp function. A proof of concept exploit involves calling the function with a very large float value: tf.raw_ops.RaggedRange(starts=[1.1,0.1], limits=[10.0,1e20], deltas=[1,1]) (GitHub Advisory).

The vulnerability has been patched in TensorFlow versions 2.7.4, 2.8.3, 2.9.2, and 2.10.0. Users are advised to upgrade to these patched versions. The fix includes proper overflow checking when converting float values to int64 (GitHub Advisory).