CVE-2022-35967: 
Python vulnerability analysis and mitigation

TensorFlow, an open source platform for machine learning, was found to contain a vulnerability (CVE-2022-35967) in its QuantizedAdd operation. The vulnerability was discovered when min_input or max_input tensors of nonzero rank were provided to the operation, resulting in a segmentation fault. This issue was identified and reported by Neophytos Christou from Secure Systems Labs, Brown University (GitHub Advisory).

The vulnerability occurs specifically in the QuantizedAdd operation when input tensors min_input or max_input have a nonzero rank, leading to a segmentation fault. The issue affects TensorFlow versions prior to 2.10.0, including versions 2.7.x, 2.8.x, and 2.9.x that were still in the supported range. The vulnerability was patched through GitHub commit 49b3824d83af706df0ad07e4e677d88659756d89, which added IsScalar (rank == 0) checks to min/max input tensors (GitHub Commit).

The vulnerability can be exploited to trigger a denial of service attack through a segmentation fault when providing specifically crafted input tensors to the QuantizedAdd operation (GitHub Advisory).

The vulnerability has been patched in TensorFlow versions 2.7.4, 2.8.3, 2.9.2, and 2.10.0. Users are advised to upgrade to these patched versions as there are no known workarounds for this issue (GitHub Advisory).