CVE-2022-35984: 
Python vulnerability analysis and mitigation

CVE-2022-35984 is a vulnerability discovered in TensorFlow affecting versions prior to 2.10.0. The vulnerability was disclosed on September 15, 2022, and affects the ParameterizedTruncatedNormal operation in TensorFlow. The issue impacts multiple versions of TensorFlow packages including tensorflow, tensorflow-cpu, and tensorflow-gpu distributed through pip (TF Advisory).

The vulnerability stems from an incorrect assumption in the ParameterizedTruncatedNormal operation where the shape parameter is assumed to be of type int32. When a valid shape of type int64 is provided, it results in a mismatched type CHECK fail. This type confusion issue was addressed with improved checks in the TensorFlow codebase (TF Commit).

The vulnerability can be exploited to trigger a denial of service attack when providing a shape parameter of type int64 to the ParameterizedTruncatedNormal operation. This can cause the application to crash due to the mismatched type check failure (TF Advisory).

The vulnerability requires an attacker to provide specific input to the ParameterizedTruncatedNormal operation with a shape parameter of type int64. A proof of concept exploit has been documented that demonstrates how to trigger the vulnerability using TensorFlow's raw operations API (TF Advisory).

The vulnerability has been patched in multiple TensorFlow versions: 2.7.4, 2.8.3, 2.9.2, and 2.10.0. Users are advised to upgrade to these patched versions to mitigate the vulnerability. The fix involves improving type handling in the ParameterizedTruncatedNormal operation (TF Advisory).