You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

sklearn DecisionTree SIGSEGV via OOB Node Traversal

Security research artifact. Do not use in production.

Summary

scikit-learn 1.8.0's Tree.__setstate__ does not validate that left_child and right_child indices in the deserialized nodes array are within bounds. A crafted .joblib file can set left_child[0] to an arbitrary value (e.g., 999999). When predict() traverses the tree, it follows this index into unallocated heap memory, causing SIGSEGV.

The crash is signal 11 (SIGSEGV), not a Python exception -- it kills the entire process at the OS level.

Impact

CWE-125: Out-of-bounds Read (tree traversal reads past allocated buffer)
CWE-682: Incorrect Calculation (predictions computed from OOB heap data)
SIGSEGV process crash from loading and predicting with a crafted model
Silent wrong predictions when heap contains valid-looking node data
Affects ALL tree-based estimators: DecisionTree, RandomForest, GradientBoosting, ExtraTrees, AdaBoost, BaggingClassifier

Files

poc_segfault.joblib -- Pre-built malicious model (left_child[0] = 999999)
poc_sklearn_tree_segfault.py -- Full PoC: creates multiple crash variants, tests in subprocesses

Reproduction

pip install scikit-learn==1.8.0 joblib numpy
python3 poc_sklearn_tree_segfault.py

Quick test with the pre-built file:

python3 -c "
import joblib, numpy as np
clf = joblib.load('poc_segfault.joblib')
clf.predict(np.array([[1, 2]]))
"
echo $?  # prints 139 (128 + 11 = SIGSEGV)

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support