CVE-2022-45908 (published 2022-11-26T02:15Z)

In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead to arbitrary code execution.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-94
cwe_name: Improper Control of Generation of Code ('Code Injection')
description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
extended_description: 
            When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. Such an alteration could lead to arbitrary code execution.
            Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.
         
         

Fix information:
repo_url: https://github.com/PaddlePaddle/Paddle
commit_details: repo_url: https://github.com/PaddlePaddle/Paddle
author: YangZhou
author_date: 2022-10-28 18:15:55+08:00
msg: [audio]fix audio get_window security error (#47386)

* fix window security error

* format
repository: repo_url: https://github.com/PaddlePaddle/Paddle
repo_name: PaddlePaddle/Paddle
description: PArallel Distributed Deep LEarning: Machine Learning Framework from Industrial Practice （『飞桨』核心框架，深度学习&机器学习高性能单机、分布式训练和跨平台部署）
repo_language: C++
owner: PaddlePaddle
file_changes: filename: window.py
change_type: ModificationType.MODIFY
diff: @@ -19,17 +19,39 @@ import paddle
 from paddle import Tensor
 
 
+class WindowFunctionRegister(object):
+    def __init__(self):
+        self._functions_dict = dict()
+
+    def register(self, func=None):
+        def add_subfunction(func):
+            name = func.__name__
+            self._functions_dict[name] = func
+            return func
+
+        return add_subfunction
+
+    def get(self, name):
+        return self._functions_dict[name]
+
+
+window_function_register = WindowFunctionRegister()
+
+
+@window_function_register.register()
 def _cat(x: List[Tensor], data_type: str) -> Tensor:
     l = [paddle.to_tensor(_, data_type) for _ in x]
     return paddle.concat(l)
 
 
+@window_function_register.register()
 def _acosh(x: Union[Tensor, float]) -> Tensor:
     if isinstance(x, float):
         return math.log(x + math.sqrt(x**2 - 1))
     return paddle.log(x + paddle.sqrt(paddle.square(x) - 1))
 
 
+@window_function_register.register()
 def _extend(M: int, sym: bool) -> bool:
     """Extend window by 1 sample if needed for DFT-even symmetry."""
     if not sym:
@@ -38,6 +60,7 @@ def _extend(M: int, sym: bool) -> bool:
         return M, False
 
 
+@window_function_register.register()
 def _len_guards(M: int) -> bool:
     """Handle small or incorrect window lengths."""
     if int(M) != M or M < 0:
@@ -46,6 +69,7 @@ def _len_guards(M: int) -> bool:
     return M <= 1
 
 
+@window_function_register.register()
 def _truncate(w: Tensor, needed: bool) -> Tensor:
     """Truncate window by 1 sample if needed for DFT-even symmetry."""
     if needed:
@@ -54,6 +78,7 @@ def _truncate(w: Tensor, needed: bool) -> Tensor:
         return w
 
 
+@window_function_register.register()
 def _general_gaussian(
     M: int, p, sig, sym: bool = True, dtype: str = 'float64'
 ) -> Tensor:
@@ -70,6 +95,7 @@ def _general_gaussian(
     return _truncate(w, needs_trunc)
 
 
+@window_function_register.register()
 def _general_cosine(
     M: int, a: float, sym: bool = True, dtype: str = 'float64'
 ) -> Tensor:
@@ -86,6 +112,7 @@ def _general_cosine(
     return _truncate(w, needs_trunc)
 
 
+@window_function_register.register()
 def _general_hamming(
     M: int, alpha: float, sym: bool = True, dtype: str = 'float64'
 ) -> Tensor:
@@ -95,6 +122,7 @@ def _general_hamming(
     return _general_cosine(M, [alpha, 1.0 - alpha], sym, dtype=dtype)
 
 
+@window_function_register.register()
 def _taylor(
     M: int, nbar=4, sll=30, norm=True, sym: bool = True, dtype: str = 'float64'
 ) -> Tensor:
@@ -151,6 +179,7 @@ def _taylor(
     return _truncate(w, needs_trunc)
 
 
+@window_function_register.register()
 def _hamming(M: int, sym: bool = True, dtype: str = 'float64') -> Tensor:
     """Compute a Hamming window.
     The Hamming window is a taper formed by using a raised cosine with
@@ -159,6 +188,7 @@ def _hamming(M: int, sym: bool = True, dtype: str = 'float64') -> Tensor:
     return _general_hamming(M, 0.54, sym, dtype=dtype)
 
 
+@window_function_register.register()
 def _hann(M: int, sym: bool = True, dtype: str = 'float64') -> Tensor:
     """Compute a Hann window.
     The Hann window is a taper formed by using a raised cosine or sine-squared
@@ -167,6 +197,7 @@ def _hann(M: int, sym: bool = True, dtype: str = 'float64') -> Tensor:
     return _general_hamming(M, 0.5, sym, dtype=dtype)
 
 
+@window_function_register.register()
 def _tukey(
     M: int, alpha=0.5, sym: bool = True, dtype: str = 'float64'
 ) -> Tensor:
@@ -200,6 +231,7 @@ def _tukey(
     return _truncate(w, needs_trunc)
 
 
+@window_function_register.register()
 def _kaiser(
     M: int, beta: float, sym: bool = True, dtype: str = 'float64'
 ) -> Tensor:
@@ -209,6 +241,7 @@ def _kaiser(
     raise NotImplementedError()
 
 
+@window_function_register.register()
 def _gaussian(
     M: int, std: float, sym: bool = True, dtype: str = 'float64'
 ) -> Tensor:
@@ -226,6 +259,7 @@ def _gaussian(
     return _truncate(w, needs_trunc)
 
 
+@window_function_register.register()
 def _exponential(
     M: int, center=None, tau=1.0, sym: bool = True, dtype: str = 'float64'
 ) -> Tensor:
@@ -245,6 +279,7 @@ def _exponential(
     return _truncate(w, needs_trunc)
 
 
+@window_function_register.register()
 def _triang(M: int, sym: bool = True, dtype: str = 'float64') -> Tensor:
     """Compute a triangular window."""
     if _len_guards(M):
@@ -262,6 +297,7 @@ def _triang(M: int, sym: bool = True, dtype: str = 'float64') -> Tensor:
     return _truncate(w, needs_trunc)
 
 
+@window_function_register.register()
 def _bohman(M: int, sym: bool = True, dtype: str = 'float64') -> Tensor:
     """Compute a Bohman window.
     The Bohman window is the autocorrelation of a cosine window.
@@ -279,6 +315,7 @@ def _bohman(M: int, sym: bool = True, dtype: str = 'float64') -> Tensor:
     return _truncate(w, needs_trunc)
 
 
+@window_function_register.register()
 def _blackman(M: int, sym: bool = True, dtype: str = 'float64') -> Tensor:
     """Compute a Blackman window.
     The Blackman window is a taper formed by using the first three terms of
@@ -289,6 +326,7 @@ def _blackman(M: int, sym: bool = True, dtype: str = 'float64') -> Tensor:
     return _general_cosine(M, [0.42, 0.50, 0.08], sym, dtype=dtype)
 
 
+@window_function_register.register()
 def _cosine(M: int, sym: bool = True, dtype: str = 'float64') -> Tensor:
     """Compute a window with a simple cosine shape."""
     if _len_guards(M):
@@ -308,7 +346,7 @@ def get_window(
     """Return a window of a given length and type.
 
     Args:
-        window (Union[str, Tuple[str, float]]): The window function applied to the signal before the Fourier transform. Supported window functions: 'hamming', 'hann', 'kaiser', 'gaussian', 'exponential', 'triang', 'bohman', 'blackman', 'cosine', 'tukey', 'taylor'.
+        window (Union[str, Tuple[str, float]]): The window function applied to the signal before the Fourier transform. Supported window functions: 'hamming', 'hann', 'kaiser', 'gaussian', 'general_gaussian', 'exponential', 'triang', 'bohman', 'blackman', 'cosine', 'tukey', 'taylor'.
         win_length (int): Number of samples.
         fftbins (bool, optional): If True, create a "periodic" window. Otherwise, create a "symmetric" window, for use in filter design. Defaults to True.
         dtype (str, optional): The data type of the return window. Defaults to 'float64'.
@@ -348,8 +386,8 @@ def get_window(
         )
 
     try:
-        winfunc = eval('_' + winstr)
-    except NameError as e:
+        winfunc = window_function_register.get('_' + winstr)
+    except KeyError as e:
         raise ValueError("Unknown window type.") from e
 
     params = (win_length,) + args

programming_language: Python