CVE-2024-27134 — Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf

CVE-2024-27134

Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf PUBLISHED

Description (CNA)

Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.

Affected (CNA)

Vendor / product	Versions
Not supplied / Not supplied	affected 0 before 2.16.0

CWE

CWE-367, CWE-276

References

https://github.com/mlflow/mlflow/pull/10874

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.