CVE-2017-12852: Numpy missing input validation

Background

Numpy is a popular package in the Python ecosystem that provides support for large, multi-dimensional arrays and matrices, along with a collection of mathematical functions to operate on these arrays. It is widely used in scientific computing and data analysis applications. However, versions 1.13.1 and older of Numpy suffer from a vulnerability due to missing input validation in the numpy.pad function. This function allows users to add padding to arrays, but an empty list or ndarray passed as input can trigger an infinite loop, leading to a denial-of-service (DoS) attack.

Vulnerability Detail

The vulnerability in Numpy arises from the lack of input validation in the numpy.pad function. When an empty list or ndarray is provided as input, the function enters an infinite loop, causing the program to hang indefinitely. This can be exploited by attackers to launch a DoS attack, rendering the affected application unresponsive. The vulnerability has a CVSS score of 7.5, indicating a high severity level. It is classified under CWE-835.

pip install --upgrade "numpy==1.13.3"

Workaround

As a workaround, users can manually validate the input before calling the numpy.pad function. This can be done by checking if the input array is empty or if its dimensions are zero. If the input is invalid, an alternative approach or error handling mechanism can be implemented. Here is an example code snippet demonstrating the workaround:

import numpy as np

def safe_pad(array, pad_width, mode):
    if len(array) == 0 or np.prod(array.shape) == 0:
        raise ValueError('Invalid input array')
    else:
        return np.pad(array, pad_width, mode)

Conclusion

The vulnerability in Numpy, identified as CVE-2017-12852, stems from missing input validation in the numpy.pad function. By providing an empty list or ndarray as input, an infinite loop can be triggered, leading to a denial-of-service (DoS) attack. To mitigate this vulnerability, it is crucial to update Numpy to version 1.13.3 or later. Alternatively, users can implement a workaround by manually validating the input before using the numpy.pad function. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for numpy →

FAQ