Quick answers
- Is CVE-2023-52303 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2023-52303 being exploited in the wild.
- How severe is CVE-2023-52303?
- Low severity, with a CVSS score of 3.1, published 3 January 2024.
- Which products and versions are affected?
- PaddlePaddle Paddle before 2.6.0; paddlepaddle (PyPI) ECOSYSTEM:introduced=0,fixed=2.6.0.
- Is there a fix for CVE-2023-52303?
- Yes. paddlepaddle (PyPI): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2023-52303 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2023-52303?
- Check whether you run PaddlePaddle Paddle or paddlepaddle (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- paddlepaddle (PyPI): upgrade to 2.6.0 or later
pip install "paddlepaddle>=2.6.0"
Technical details
A null pointer dereference (CWE-476) exists in PaddlePaddle's paddle.put_along_axis function before version 2.6.0. The vulnerability occurs in the Python API binding layer when incorrect argument types are passed without proper validation. The fix adds a type check (!PyObject_TypeCheck(obj, p_tensor_type)) to validate that sequence arguments are not tensor objects before processing them, preventing dereferencing of invalid pointers. An attacker can exploit this with network access by sending malformed requests to services using vulnerable PaddlePaddle versions, though no user interaction is required. The impact is a denial of service through application crash; no code execution or data disclosure is possible.
Affected products
- PaddlePaddle Paddle before 2.6.0
Identifiers
- CVE-2023-52303
- GHSA-2wcj-qr76-9768
- PYSEC-2024-135
Timeline
- 2024-01-03: disclosed
- 2023-08-02: patched: Fix committed upstream