full-disclosure - [FD] scikit-learn 0.23.2 Local Denial of Service

Open Source and information security mailing list archives

Message-ID: <CAA0Z-zGrev0HcVvjKxu8gJ5pq2H_2v5rwniWd6H0a1mkwd2GwQ@mail.gmail.com>
Date: Thu, 26 Nov 2020 23:01:14 +0100
From: pabloec20 <pabloec20@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] scikit-learn 0.23.2 Local Denial of Service

[Description]

svm_predict_values in svm.cpp in  Libsvm  v324, as used in scikit-learn
0.23.2 and other products, allows attackers to  cause a denial of service
(segmentation fault) via  a crafted model SVM (introduced via  pickle,
json, or any other model permanence technique) with a large value in the
_n_support array.

[CVE ID]

CVE-2020-28975

[Vendor of Product]

 SciKit-Learn

[Affected Product Code Base]

 scikit-learn - 0.23.2

[Affected Component]

 LibSVM

[Attack Type]

 Local

[Impact]

  Denial of Service

[Attack Vectors]

 specially crafted file

[Reference]

 https://github.com/scikit-learn/scikit-learn/issues/18891
<https://github.com/scikit-learn/scikit-learn/issues/18891>

https://github.com/cjlin1/libsvm/blob/9a3a9708926dec87d382c43b203f2ca19c2d56a0/svm.cpp#L2501
<https://github.com/cjlin1/libsvm/blob/9a3a9708926dec87d382c43b203f2ca19c2d56a0/svm.cpp#L2501>

[Discoverer]

 pabloec20

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives