-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the PyObject_CheckLongOrToLong function's insufficient validation of TensorObjects. The GitHub patch specifically adds a check for 'tensor.numel() == 1' to this function, indicating it was the source of improper null handling. This function is used in type conversion for API operations like paddle.flip, and the lack of numel check in vulnerable versions would allow empty tensors to be processed, leading to dereferencing of uninitialized/null tensor data structures.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| paddlepaddle | pip | >= 0, < 2.5.0 | 2.5.0 |