Description
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Angel-ML angel
Default version status: unaffected
0 to ≤ 3.3.0affected
pkg:maven/com.tencent.angel/angelReferences
- https://github.com/Angel-ML/angel/issues/1355 ↗
- https://github.com/Angel-ML/angel ↗
- https://github.com/Angel-ML/angel/blob/Release-3.3.0/angel-ps/core/src/main/java/com/tencent/angel/utils/KryoUtils.java#L45-L70 ↗
- https://www.vulncheck.com/advisories/angel-through-3.3.0-unauthenticated-kryo-deserialization-of-arbitrary-classes ↗