CVE-2022-36013: 
Python vulnerability analysis and mitigation

TensorFlow, an open source platform for machine learning, contained a vulnerability in the mlir::tfg::GraphDefImporter::ConvertNodeDef function where attempting to convert NodeDefs without an op name would cause a crash. This vulnerability was discovered and disclosed in September 2022, affecting TensorFlow versions prior to 2.10.0 (TF Advisory).

The vulnerability occurs in the ConvertNodeDef function when processing NodeDefs that have an empty op name. The function attempts to use the empty op name without proper validation, leading to a null pointer dereference. The issue has been assigned CVE-2022-36013 and received a CVSS v3.1 base score of 7.5 HIGH from NIST NVD, while GitHub assessed it as 5.9 MEDIUM (NVD).

When exploited, this vulnerability results in a crash of the application processing the NodeDefs, leading to a denial of service condition. The vulnerability affects TensorFlow versions before 2.7.2, 2.8.1, 2.9.1, and 2.10.0 (TF Advisory).

The vulnerability requires an attacker to provide a NodeDef without an op name to the TensorFlow system. The weakness has been classified as CWE-476 (NULL Pointer Dereference) (NVD).

The issue has been patched in GitHub commit a0f0b9a21c9270930457095092f558fbad4c03e5 and included in TensorFlow 2.10.0. The fix was also backported to TensorFlow 2.9.1, 2.8.1, and 2.7.2. Users should upgrade to these patched versions. There are no known workarounds for this issue (TF Advisory).