CVE-2022-35959: 
Python vulnerability analysis and mitigation

CVE-2022-35959 affects TensorFlow, an open source platform for machine learning. The vulnerability was discovered in the implementation of AvgPool3DGradOp where insufficient validation of the input orig_input_shape parameter could lead to an overflow condition. The issue was disclosed on July 15, 2022, and affects TensorFlow versions prior to 2.10.0 (GitHub Advisory).

The vulnerability exists in the AvgPool3DGradOp implementation where the input validation for orig_input_shape is incomplete. This can result in an overflow condition that triggers a CHECK failure. The issue can be reproduced by providing specific input parameters to the AvgPool3DGrad operation, including a large value (1879048192) for the orig_input_shape parameter (GitHub Advisory).

The vulnerability can be exploited to cause a denial of service condition in applications using the affected TensorFlow versions. When successfully exploited, the overflow condition triggers a CHECK failure that can disrupt the normal operation of the application (GitHub Advisory).

The vulnerability has been patched in multiple TensorFlow versions: 2.7.4, 2.8.3, 2.9.2, and 2.10.0. The fix was implemented in GitHub commit 9178ac9d6389bdc54638ab913ea0e419234d14eb. Users are advised to upgrade to these patched versions as there are no known workarounds for this issue (GitHub Advisory).