CVE-2023-38670: Null pointer dereference in paddle.flip

Q: What is CVE-2023-38670?

CVE-2023-38670 is a vulnerability in PaddlePaddle before version 2.5.0 that allows for a null pointer dereference in the paddle.flip function, resulting in a runtime crash and denial of service.

Q: How severe is CVE-2023-38670?

CVE-2023-38670 has a severity rating of 7.5 (high).

Q: How does CVE-2023-38670 affect PaddlePaddle?

CVE-2023-38670 affects PaddlePaddle versions before 2.5.0, leading to a null pointer dereference and resulting in a runtime crash and denial of service.

Q: How can I fix CVE-2023-38670 in PaddlePaddle?

To fix CVE-2023-38670 in PaddlePaddle, please update to version 2.5.0 or later.

Q: Where can I find more information about CVE-2023-38670?

You can find more information about CVE-2023-38670 in the following references: [GitHub Advisory](https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-002.md) and [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-38670).

Published Jul 26, 2023

Updated

Null pointer dereference in paddle.flip in PaddlePaddle before 2.5.0. This resulted in a runtime crash and denial of service.

Affected Software

2 affected componentsFixes available

pip/paddlepaddle>=0<2.5.0

2.5.0

PaddlePaddle paddlepaddle<2.5.0

Remediation

Patch Available

https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-002.md

Event History

Jul 26, 2023

CVE Published

via MITRE·10:50 AM

Data Sourced

via MITRE·10:50 AM

DescriptionSeverityWeakness

Advisory Published

12:30 PM

Frequently Asked Questions

What is CVE-2023-38670?

CVE-2023-38670 is a vulnerability in PaddlePaddle before version 2.5.0 that allows for a null pointer dereference in the paddle.flip function, resulting in a runtime crash and denial of service.

How severe is CVE-2023-38670?