Executive brief
PaddlePaddle is a deep learning framework used for training and deploying machine learning models. A null pointer vulnerability in the paddle.put_along_axis function can crash applications using this library, causing service disruptions and affecting model serving pipelines that rely on continuous availability.
Technical details
A null pointer dereference (CWE-476) exists in PaddlePaddle's paddle.put_along_axis function before version 2.6.0. The vulnerability occurs in the Python API binding layer when incorrect argument types are passed without proper validation. The fix adds a type check (!PyObject_TypeCheck(obj, p_tensor_type)) to validate that sequence arguments are not tensor objects before processing them, preventing dereferencing of invalid pointers. An attacker can exploit this with network access by sending malformed requests to services using vulnerable PaddlePaddle versions, though no user interaction is required. The impact is a denial of service through application crash; no code execution or data disclosure is possible.
Affected products
- PaddlePaddle Paddle before 2.6.0
Timeline
- 2024-01-03: disclosed
- 2023-08-02: patched: Fix committed upstream