Out-of-bounds Write Affecting lightgbm package, versions [0,]


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept
EPSS
0.14% (51st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PYTHON-LIGHTGBM-8516056
  • published17 Dec 2024
  • disclosed12 Nov 2024
  • creditTian Yu

Introduced: 12 Nov 2024

CVE-2024-43598  (opens in a new tab)
CWE-787  (opens in a new tab)

How to fix?

A fix was pushed into the master branch but not yet published.

Overview

lightgbm is a gradient boosting framework that uses tree based learning algorithms.

Affected versions of this package are vulnerable to Out-of-bounds Write in linkers_socket.cpp, used during initialization of distributed training. An attacker can exploit a race condition to connect to a node while it is waiting for a legitimate connection from a configured peer, and send an arbitrary rank value. This may trigger an exploitable crash on the affected node.

CVSS Scores

version 4.0
version 3.1