CVE-2022-36000: 
Python vulnerability analysis and mitigation

CVE-2022-36000 is a vulnerability in TensorFlow's Eig operation where incorrect output data type (Tout) parameters can trigger a CHECK failure, potentially leading to a denial of service. The vulnerability was discovered in TensorFlow versions prior to 2.10.0 and was reported by 刘力源 from the Information System & Security and Countermeasures Experiments Center at Beijing Institute of Technology (GitHub Advisory).

The vulnerability exists in TensorFlow's LinearAlgebraOp implementation where the Eig operation could accept mismatched data types between input and output parameters. When calling the tf.raw_ops versions, it was possible to provide incorrect output scalar types that would cause a failing check during computation. The issue was fixed by adding input validation checks to verify the compatibility of input and output data types (GitHub Commit).

The vulnerability can result in a denial of service condition when an attacker provides mismatched input and output data types to the Eig operation. The severity of this vulnerability is rated as Low (GitHub Advisory).

The vulnerability has been patched in TensorFlow versions 2.7.4, 2.8.3, 2.9.2, and 2.10.0. Users are advised to upgrade to these patched versions to mitigate the issue (GitHub Advisory).