CVE-2023-38670
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A null pointer dereference in paddle.flip in PaddlePaddle before version 2.5.0 results in a runtime crash and denial of service.
Risk Assessment
Organizations may experience application downtime when using PaddlePaddle, impacting service availability.
Recommendation
It is recommended to upgrade PaddlePaddle to version 2.5.0 or later to mitigate this vulnerability.
Other vulnerabilities in PaddlePaddle
See all- CVE-2023-38673Critical
PaddlePaddle before 2.5.0 has a command injection in fs.py, allowing for the execution of arbitrary commands on the operating system.
- CVE-2023-38672Medium
There is an FPE vulnerability in paddle.trace in PaddlePaddle before version 2.5.0, which can lead to runtime crashes and denial of service.
- CVE-2023-38671High
Heap buffer overflow in paddle.trace in PaddlePaddle before version 2.5.0. This flaw can lead to denial of service, information disclosure, or more damage is possible.
- CVE-2023-38669High
There is a use after free vulnerability in paddle.diagonal in PaddlePaddle before version 2.5.0, leading to a potentially exploitable condition.
Original NVD description (English source)
Null pointer dereference in paddle.flip in PaddlePaddle before 2.5.0. This resulted in a runtime crash and denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS