CVE-2023-52313: PYSEC-2024-145 - FPE in paddle.argmin and paddle.argmax in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.

CVE-2023-52313 · Severity: low · CVSS 3.1 · Published 2024-01-03

PaddlePaddle is a popular machine learning framework used for deep learning and data science tasks. A floating point exception flaw in the argmin and argmax functions can cause the application to crash unexpectedly, disrupting model inference and training operations. An attacker or user providing specially crafted input to these functions could trigger a denial of service.

Technologies: PaddlePaddle Paddle, paddlepaddle (PyPI). Vendors: PaddlePaddle, PyPI.

Quick answers

Is CVE-2023-52313 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-52313 being exploited in the wild.
How severe is CVE-2023-52313?
Low severity, with a CVSS score of 3.1, published 3 January 2024.
Which products and versions are affected?
PaddlePaddle Paddle before 2.6.0; paddlepaddle (PyPI) ECOSYSTEM:introduced=0,fixed=2.6.0.
Is there a fix for CVE-2023-52313?
Yes. paddlepaddle (PyPI): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-52313 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-52313?
Check whether you run PaddlePaddle Paddle or paddlepaddle (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • paddlepaddle (PyPI): upgrade to 2.6.0 or later
    pip install "paddlepaddle>=2.6.0"

Technical details

The vulnerability is a floating point exception (FPE / CWE-369) in the paddle.argmin and paddle.argmax functions in PaddlePaddle versions before 2.6.0. The root cause is insufficient input validation that fails to check for invalid arguments before performing division or modulo operations. An attacker can trigger the exception remotely by submitting malformed tensors or invalid axis parameters to these functions, causing a runtime crash and denial of service. No special privileges or authentication are required; the vulnerability requires user interaction to trigger. A fix is available in version 2.6.0.

Affected products

  • PaddlePaddle Paddle before 2.6.0

Identifiers

  • CVE-2023-52313
  • GHSA-275c-w5mq-v5m2
  • PYSEC-2024-145

Timeline

  • 2024-01-03: disclosed
  • 2024-01-03: patched: Fix available in version 2.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.