Buffer overflow in Scikit-learn - CVE-2020-28975
Published: August 13, 2024
Vulnerability identifier: #VU95807
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-28975
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing SVM models within the svm_predict_values in svm.cpp. A remote attacker can pass a specially crafted model to the application, trigger memory corruption and perform a denial of service (DoS) attack.
Affected software
Scikit-learn
Gentoo Linux
Python for Scientific Computing
Oracle Business Intelligence Enterprise Edition
sci-libs/scikit-learn
Gentoo Linux
Python for Scientific Computing
Oracle Business Intelligence Enterprise Edition
sci-libs/scikit-learn
How to mitigate CVE-2020-28975
Install update from vendor's website.
Scikit-learn - update to 1.0.1
Python for Scientific Computing - update to 4.2.1
sci-libs/scikit-learn - update to 1.1.1
Python for Scientific Computing - update to 4.2.1
sci-libs/scikit-learn - update to 1.1.1
External References
- https://github.com/scikit-learn/scikit-learn/issues/18891
- https://github.com/cjlin1/libsvm/blob/9a3a9708926dec87d382c43b203f2ca19c2d56a0/svm.cpp#L2501
- http://seclists.org/fulldisclosure/2020/Nov/44
- http://packetstormsecurity.com/files/160281/SciKit-Learn-0.23.2-Denial-Of-Service.html
- https://github.com/scikit-learn/scikit-learn/commit/1bf13d567d3cd74854aa8343fd25b61dd768bb85
- https://security.gentoo.org/glsa/202301-03