CVE-2024-27134
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.
Reserved 2024-02-20 | Published 2024-11-25 | Updated 2024-11-25 | Assigner JFROGCWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-276 Incorrect Default Permissions
github.com/mlflow/mlflow/pull/10874
Support options
