CVE-2024-0521: PaddlePaddle Code Injection RCE Vulnerability

CVE-2024-0521 Overview

CVE-2024-0521 is a code injection vulnerability [CWE-94] affecting PaddlePaddle, an open-source deep learning framework maintained by Baidu. The flaw allows a local authenticated attacker to execute arbitrary code within the context of the PaddlePaddle process. Exploitation requires local access and low privileges but no user interaction. Successful exploitation compromises the confidentiality, integrity, and availability of the host running the vulnerable framework. The issue was reported through the Huntr bug bounty program and disclosed in January 2024.

Critical Impact
A local attacker with low privileges can inject and execute arbitrary code through PaddlePaddle, leading to full compromise of the machine learning workload and underlying host.

Affected Products

PaddlePaddle Paddle (all versions prior to the fixed release)
Deep learning pipelines that consume untrusted model artifacts or training inputs through PaddlePaddle
Multi-tenant ML training and inference hosts running vulnerable PaddlePaddle builds

Discovery Timeline

2024-01-20 - CVE-2024-0521 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0521

Vulnerability Analysis

CVE-2024-0521 is classified under CWE-94: Improper Control of Generation of Code. The vulnerability resides in PaddlePaddle functionality that processes attacker-controlled input without adequately restricting how that input is interpreted at runtime. When the framework evaluates or resolves this input, injected instructions execute inside the PaddlePaddle process. Because deep learning workloads frequently run with access to sensitive datasets, GPU resources, and model artifacts, attacker-controlled code executes with the same permissions as the ML workload.

The attack requires local access, meaning the attacker must already have some foothold on the system or must trick a local user into processing a crafted artifact. This limits remote mass exploitation but remains relevant for shared research clusters, CI/CD pipelines, and hosted notebook environments.

Root Cause

The root cause is insufficient validation of input that reaches a code-generation or evaluation path inside PaddlePaddle. Refer to the Huntr Bounty Report for the specific function and reproduction steps disclosed by the reporter.

Attack Vector

An authenticated local attacker supplies crafted input to a vulnerable PaddlePaddle API. The framework processes that input in a manner that resolves attacker-controlled data into executable code. Execution occurs in the security context of the user running PaddlePaddle. No user interaction beyond normal ML workflow execution is required.

No public exploit code or CISA KEV listing is associated with this CVE at the time of writing. Consult the linked advisory for verified technical details rather than synthetic proof-of-concept code.

Detection Methods for CVE-2024-0521

Indicators of Compromise

Unexpected child processes spawned by Python interpreters running PaddlePaddle workloads, such as shells, curl, wget, or compilers
Outbound network connections initiated by ML training or inference processes to unfamiliar hosts
Modifications to files outside the expected model, dataset, or checkpoint directories
New cron jobs, systemd units, or shell profile modifications created by the account running PaddlePaddle

Detection Strategies

Monitor for anomalous process lineage where python, paddle, or Jupyter kernels invoke system utilities inconsistent with training workflows
Track file integrity of PaddlePaddle installation directories and any user-supplied model or configuration files
Correlate PaddlePaddle process activity with authentication and session data to identify local privilege escalation attempts

Monitoring Recommendations

Enable command-line and process-creation auditing on hosts that run PaddlePaddle workloads
Log Python subprocess, os.system, and eval/exec invocations where feasible using runtime instrumentation
Alert on writes to user startup files (~/.bashrc, ~/.profile, ~/.ssh/authorized_keys) originating from ML processes

How to Mitigate CVE-2024-0521

Immediate Actions Required

Inventory all hosts, containers, and virtual environments running PaddlePaddle and record installed versions
Upgrade PaddlePaddle to the fixed release identified in the vendor advisory referenced by the Huntr Bounty Report
Restrict local access to systems running PaddlePaddle to trusted users and service accounts only
Treat all externally sourced models, datasets, and configuration files as untrusted until scanned

Patch Information

PaddlePaddle released a fix following the Huntr disclosure. Review the Huntr Bounty Report and the PaddlePaddle release notes to identify the patched version and apply it via pip install --upgrade paddlepaddle or the equivalent GPU package.

Workarounds

Run PaddlePaddle workloads inside minimally privileged containers with read-only file systems where possible
Isolate ML training and inference from production data and secrets using dedicated service accounts
Apply mandatory access controls such as AppArmor or SELinux profiles restricting subprocess execution and network egress from Python interpreters
Validate and sandbox any third-party model artifacts before loading them into PaddlePaddle

bash

# Configuration example
pip install --upgrade paddlepaddle
python -c "import paddle; print(paddle.__version__)"