Vulnerability identifier: #VU95807

Vulnerability risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-28975

CWE-ID: CWE-119

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Scikit-learn
/

Vendor: scikit-learn.org

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing SVM models within the svm_predict_values in svm.cpp. A remote attacker can pass a specially crafted model to the application, trigger memory corruption and perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Scikit-learn: 0.1 - 1.0 rc2

---

External links
http://github.com/scikit-learn/scikit-learn/issues/18891
http://github.com/cjlin1/libsvm/blob/9a3a9708926dec87d382c43b203f2ca19c2d56a0/svm.cpp#L2501
http://seclists.org/fulldisclosure/2020/Nov/44
http://packetstormsecurity.com/files/160281/SciKit-Learn-0.23.2-Denial-Of-Service.html
http://github.com/scikit-learn/scikit-learn/commit/1bf13d567d3cd74854aa8343fd25b61dd768bb85
http://security.gentoo.org/glsa/202301-03

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.