CVE-2022-35999: 
Python vulnerability analysis and mitigation

CVE-2022-35999 affects TensorFlow, an open source platform for machine learning. The vulnerability was discovered in July 2022 and publicly disclosed in September 2022. The issue occurs when the Conv2DBackpropInput function receives empty out_backprop inputs (e.g. [3, 1, 0, 1]), causing CPU/GPU kernels CHECK to fail with both DNNL and CUDNN implementations (GitHub Advisory).

The vulnerability is caused by a failure in the CPU/GPU kernels' CHECK mechanism when processing empty out_backprop inputs in the Conv2DBackpropInput function. The issue affects multiple versions of TensorFlow including versions up to 2.7.2, 2.8.0 to 2.8.1, and 2.9.0 to 2.9.1. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) by NVD with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can be exploited to trigger a denial of service attack when the Conv2DBackpropInput function receives empty out_backprop inputs, potentially disrupting the normal operation of systems using TensorFlow (GitHub Advisory).

The vulnerability has been patched in TensorFlow versions 2.7.4, 2.8.3, 2.9.2, and 2.10.0. The fix was implemented in GitHub commit 27a65a43cf763897fecfa5cdb5cc653fc5dd0346, which adds a shortcut path to return a zero input when empty out_backprop inputs are detected. There are no known workarounds for affected versions (GitHub Advisory).