Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.2epss 0.4%
exploitation probability
0.4%top 70% of all CVEs
observed exploitation
nono source reports it
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Angel-ML · angelReferences
https://github.com/Angel-ML/angelhttps://github.com/Angel-ML/angel/blob/Release-3.3.0/angel-ps/core/src/main/java/com/tencent/angel/utils/KryoUtils.java#L45-L70https://github.com/Angel-ML/angel/issues/1355https://www.vulncheck.com/advisories/angel-through-3.3.0-unauthenticated-kryo-deserialization-of-arbitrary-classes