CVE-2022-35965: 
Python vulnerability analysis and mitigation

TensorFlow, an open source platform for machine learning, was found to contain a vulnerability (CVE-2022-35965) where the LowerBound or UpperBound functions could trigger a segmentation fault when provided with empty sorted_inputs. The vulnerability was discovered and disclosed in September 2022, affecting TensorFlow versions prior to 2.10.0 (GitHub Advisory).

The vulnerability occurs when the LowerBound or UpperBound functions are given an empty sorted_inputs input, resulting in a nullptr dereference that leads to a segmentation fault. This vulnerability affects multiple versions of TensorFlow, including versions 2.7.x, 2.8.x, and 2.9.x (GitHub Advisory).

The vulnerability can be exploited to trigger a denial of service attack by causing the application to crash through a segmentation fault when processing empty inputs (GitHub Advisory).

The issue has been patched in TensorFlow 2.10.0 and backported to versions 2.7.4, 2.8.3, and 2.9.2. The fix was implemented in GitHub commit bce3717eaef4f769019fd18e990464ca4a2efeea. Users should upgrade to the patched versions to mitigate this vulnerability (GitHub Advisory).