CVE-2023-2970 - Vulnerability Details - OpenCVE

A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the function JsonHelper::UpdateArray of the file mindspore/ccsrc/minddata/dataset/util/json_helper.cc. The manipulation leads to memory corruption. The name of the patch is 30f4729ea2c01e1ed437ba92a81e2fc098d608a9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-230176.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Adjacent Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Mindspore	Mindspore

Configuration 1 [-]

OR	cpe:2.3:a:mindspore:mindspore:2.0.0:alpha::::::
	cpe:2.3:a:mindspore:mindspore:2.0.0:rc1::::::

No data.

References

Link	Providers
https://gitee.com/mindspore/mindspore/commit/30f4729ea2c01e1ed437ba92a81e2fc098d608a9
https://gitee.com/mindspore/mindspore/issues/I73DOS
https://vuldb.com/?ctiid.230176
https://vuldb.com/?id.230176

History

Fri, 22 Nov 2024 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2023-05-30T05:31:03.695Z

Updated: 2024-11-22T18:01:00.795Z

Reserved: 2023-05-30T04:58:32.620Z

Link: CVE-2023-2970

Vulnrichment

Updated: 2024-08-02T06:41:04.195Z

NVD

Status : Modified

Published: 2023-05-30T06:16:30.853

Modified: 2024-11-21T07:59:39.983

Link: CVE-2023-2970

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-2970", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2023-05-30T04:58:32.620Z", "datePublished": "2023-05-30T05:31:03.695Z", "dateUpdated": "2024-11-22T18:01:00.795Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2023-10-23T07:23:08.445Z"}, "title": "MindSpore json_helper.cc UpdateArray memory corruption", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "CWE-119 Memory Corruption"}]}], "affected": [{"vendor": "n/a", "product": "MindSpore", "versions": [{"version": "2.0.0-alpha", "status": "affected"}, {"version": "2.0.0-rc1", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the function JsonHelper::UpdateArray of the file mindspore/ccsrc/minddata/dataset/util/json_helper.cc. The manipulation leads to memory corruption. The name of the patch is 30f4729ea2c01e1ed437ba92a81e2fc098d608a9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-230176."}, {"lang": "de", "value": "In MindSpore 2.0.0-alpha/2.0.0-rc1 wurde eine Schwachstelle entdeckt. Sie wurde als problematisch eingestuft. Das betrifft die Funktion JsonHelper::UpdateArray der Datei mindspore/ccsrc/minddata/dataset/util/json_helper.cc. Dank Manipulation mit unbekannten Daten kann eine memory corruption-Schwachstelle ausgenutzt werden. Der Patch wird als 30f4729ea2c01e1ed437ba92a81e2fc098d608a9 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.7, "vectorString": "AV:A/AC:L/Au:S/C:N/I:N/A:P"}}], "timeline": [{"time": "2023-05-30T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2023-05-30T00:00:00.000Z", "lang": "en", "value": "CVE reserved"}, {"time": "2023-05-30T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2023-06-22T01:47:14.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "VulDB Gitee Analyzer", "type": "tool"}], "references": [{"url": "https://vuldb.com/?id.230176", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.230176", "tags": ["signature", "permissions-required"]}, {"url": "https://gitee.com/mindspore/mindspore/issues/I73DOS", "tags": ["issue-tracking"]}, {"url": "https://gitee.com/mindspore/mindspore/commit/30f4729ea2c01e1ed437ba92a81e2fc098d608a9", "tags": ["patch"]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:41:04.195Z"}, "title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.230176", "tags": ["vdb-entry", "technical-description", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.230176", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://gitee.com/mindspore/mindspore/issues/I73DOS", "tags": ["issue-tracking", "x_transferred"]}, {"url": "https://gitee.com/mindspore/mindspore/commit/30f4729ea2c01e1ed437ba92a81e2fc098d608a9", "tags": ["patch", "x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-22T18:00:53.595198Z", "id": "CVE-2023-2970", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-22T18:01:00.795Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.230176", "tags": ["vdb-entry", "technical-description", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.230176", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://gitee.com/mindspore/mindspore/issues/I73DOS", "tags": ["issue-tracking", "x_transferred"]}, {"url": "https://gitee.com/mindspore/mindspore/commit/30f4729ea2c01e1ed437ba92a81e2fc098d608a9", "tags": ["patch", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:41:04.195Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-2970", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-22T18:00:53.595198Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-22T18:00:57.789Z"}}], "cna": {"title": "MindSpore json_helper.cc UpdateArray memory corruption", "credits": [{"lang": "en", "type": "tool", "value": "VulDB Gitee Analyzer"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.7, "vectorString": "AV:A/AC:L/Au:S/C:N/I:N/A:P"}}], "affected": [{"vendor": "n/a", "product": "MindSpore", "versions": [{"status": "affected", "version": "2.0.0-alpha"}, {"status": "affected", "version": "2.0.0-rc1"}]}], "timeline": [{"lang": "en", "time": "2023-05-30T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2023-05-30T00:00:00.000Z", "value": "CVE reserved"}, {"lang": "en", "time": "2023-05-30T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2023-06-22T01:47:14.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.230176", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.230176", "tags": ["signature", "permissions-required"]}, {"url": "https://gitee.com/mindspore/mindspore/issues/I73DOS", "tags": ["issue-tracking"]}, {"url": "https://gitee.com/mindspore/mindspore/commit/30f4729ea2c01e1ed437ba92a81e2fc098d608a9", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the function JsonHelper::UpdateArray of the file mindspore/ccsrc/minddata/dataset/util/json_helper.cc. The manipulation leads to memory corruption. The name of the patch is 30f4729ea2c01e1ed437ba92a81e2fc098d608a9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-230176."}, {"lang": "de", "value": "In MindSpore 2.0.0-alpha/2.0.0-rc1 wurde eine Schwachstelle entdeckt. Sie wurde als problematisch eingestuft. Das betrifft die Funktion JsonHelper::UpdateArray der Datei mindspore/ccsrc/minddata/dataset/util/json_helper.cc. Dank Manipulation mit unbekannten Daten kann eine memory corruption-Schwachstelle ausgenutzt werden. Der Patch wird als 30f4729ea2c01e1ed437ba92a81e2fc098d608a9 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "CWE-119 Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2023-10-23T07:23:08.445Z"}}}, "cveMetadata": {"cveId": "CVE-2023-2970", "state": "PUBLISHED", "dateUpdated": "2024-11-22T18:01:00.795Z", "dateReserved": "2023-05-30T04:58:32.620Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2023-05-30T05:31:03.695Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mindspore:mindspore:2.0.0:alpha:*:*:*:*:*:*", "matchCriteriaId": "05B517AD-3FC7-4D69-8363-EC68AA775567", "vulnerable": true}, {"criteria": "cpe:2.3:a:mindspore:mindspore:2.0.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "589AF81E-B22E-450E-AFCE-8570A317FEA5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the function JsonHelper::UpdateArray of the file mindspore/ccsrc/minddata/dataset/util/json_helper.cc. The manipulation leads to memory corruption. The name of the patch is 30f4729ea2c01e1ed437ba92a81e2fc098d608a9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-230176."}], "id": "CVE-2023-2970", "lastModified": "2024-11-21T07:59:39.983", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 2.7, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 5.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-05-30T06:16:30.853", "references": [{"source": "cna@vuldb.com", "tags": ["Permissions Required"], "url": "https://gitee.com/mindspore/mindspore/commit/30f4729ea2c01e1ed437ba92a81e2fc098d608a9"}, {"source": "cna@vuldb.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://gitee.com/mindspore/mindspore/issues/I73DOS"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required"], "url": "https://vuldb.com/?ctiid.230176"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required"], "url": "https://vuldb.com/?id.230176"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://gitee.com/mindspore/mindspore/commit/30f4729ea2c01e1ed437ba92a81e2fc098d608a9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://gitee.com/mindspore/mindspore/issues/I73DOS"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://vuldb.com/?ctiid.230176"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://vuldb.com/?id.230176"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "cna@vuldb.com", "type": "Secondary"}]}