CVE-2023-52306: 
Python vulnerability analysis and mitigation

A floating-point exception (FPE) vulnerability was discovered in paddle.lerp function in PaddlePaddle versions before 2.6.0. The vulnerability was assigned CVE-2023-52306 and was reported by Tong Liu of CAS-IIE (Vendor Advisory).

The vulnerability occurs in the paddle.lerp function when tensor shape is invalid. It has been assigned a CVSS v3.1 base score of 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) by NIST NVD, while Baidu assessed it as 4.7 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L). The vulnerability is classified as CWE-369 (Divide By Zero) (NVD).

This vulnerability can cause a runtime crash and a denial of service when exploited (NVD).

The vulnerability can be triggered by providing invalid tensor shapes to the paddle.lerp function. A proof of concept exploit has been published that demonstrates the issue using random uniform tensors with specific shapes (Vendor Advisory).

The vulnerability has been patched in commit 19da5c0c4d8c5e4dfef2a92e24141c3f51884dcc and the fix is included in PaddlePaddle version 2.6.0. Users are advised to upgrade to this version or later (Vendor Advisory).