CVE-2022-35988: 
Python vulnerability analysis and mitigation

TensorFlow, an open source platform for machine learning, was found to contain a vulnerability (CVE-2022-35988) where the tf.linalg.matrix_rank function could trigger a denial of service when receiving an empty input on GPU kernels. The vulnerability was discovered by Kang Hong Jin and was patched in TensorFlow versions 2.7.4, 2.8.3, 2.9.2, and 2.10.0 (GitHub Advisory).

The vulnerability occurs when tf.linalg.matrix_rank receives an empty input 'a', causing the GPU kernel to fail with a 'CHECK' failure. This can be triggered by passing an empty tensor with shape [0, 1, 1] to the matrix_rank function. The issue was fixed in GitHub commit c55b476aa0e0bd4ee99d0f3ad18d9d706cd1260a by adding a check for zero batches and returning early in such cases (GitHub Commit).

The vulnerability can be exploited to trigger a denial of service attack when processing empty inputs through the tf.linalg.matrix_rank function on GPU-enabled systems (GitHub Advisory).

Users should upgrade to the patched versions: TensorFlow 2.7.4, 2.8.3, 2.9.2, or 2.10.0. The fix was implemented by adding proper handling of zero-batch cases in the GPU kernel implementation (GitHub Advisory).