CVE-2023-38675: 
Python vulnerability analysis and mitigation

CVE-2023-38675 is a floating-point exception (FPE) vulnerability discovered in the paddle.linalg.matrix_rank function of PaddlePaddle versions prior to 2.6.0. The vulnerability was reported by Tong Liu of ShanghaiTech University and was disclosed on January 3, 2024 (NVD, Paddle Advisory).

The vulnerability occurs when the matrix_rank function processes input with dimensions that calculate to 0 rows or columns, triggering a floating-point exception during the calculation of numel / (rows * cols). The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) by NIST NVD, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. However, Baidu Inc. assessed it with a lower CVSS score of 4.7 (MEDIUM) (NVD).

When exploited, this vulnerability can cause a runtime crash and lead to a denial of service condition in the affected PaddlePaddle installation (NVD).

The vulnerability can be triggered by providing a specifically crafted input tensor with zero dimensions. A proof of concept exists that demonstrates the vulnerability by using numpy to create a random uniform array with zero dimensions and converting it to a paddle tensor before calling the matrix_rank function (Paddle Advisory).

The vulnerability has been patched in PaddlePaddle version 2.6.0. The fix was implemented in commit 9bb6c669206c4bcc3ce3f6daf8a55650e190c1a1. Users are advised to upgrade to PaddlePaddle version 2.6.0 or later to address this vulnerability (Paddle Advisory).