CVE-2022-35986: 
Python vulnerability analysis and mitigation

TensorFlow, an open source platform for machine learning, was found to contain a vulnerability in its RaggedBincount operation (CVE-2022-35986). The vulnerability was discovered when RaggedBincount was given an empty input tensor 'splits', which resulted in a segmentation fault. This issue was identified in versions prior to 2.10.0 and was patched in versions 2.7.4, 2.8.3, 2.9.2, and 2.10.0 (GitHub Advisory).

The vulnerability occurs when RaggedBincount receives an empty input tensor for its 'splits' parameter, leading to a segmentation fault. The issue can be triggered by providing an empty array to the splits parameter while passing random values to other parameters including values, size, and weights. The vulnerability was fixed by adding a validation check that requires the splits parameter to be non-empty (GitHub Commit).

The vulnerability can be exploited to trigger a denial of service attack by causing the application to crash through a segmentation fault (GitHub Advisory).

Users should upgrade to the patched versions: TensorFlow 2.7.4, 2.8.3, 2.9.2, or 2.10.0. The fix implements a validation check that prevents empty splits arrays from being processed (GitHub Advisory).