PT-2024-21667 · Mlflow · Mlflow

Weichen Xu + 1 · CVE-2024-27134 · Published 2024-11-25 · Updated 2024-11-27

Positive Technologies (AI Summary)

CVSS v4.0

7.3

High

Base vector

AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MLflow (affected versions not specified)

Description The issue concerns excessive directory permissions in MLflow, which can lead to local privilege escalation when using spark udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a Time-of-Check-to-Time-of-Use (ToCToU) attack. The issue is only relevant when the spark udf() MLflow API is called.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Time Of Check To Time Of Use

Incorrect Default Permissions

Weakness Enumeration

CWE-367

CWE-276

Related Identifiers

BIT-MLFLOW-2024-27134

CVE-2024-27134

GHSA-QPGC-W4MG-6V92

PYSEC-2024-224

Affected Products

Mlflow

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27134.json · Exploit
• https://github.com/mlflow/mlflow/pull/10874 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-27134 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27134 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-224 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mlflow-2024-27134 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qpgc-w4mg-6v92 · Vendor Advisory
• https://github.com/mlflow/mlflow · Note
• https://github.com/mlflow/mlflow/commit/0b1d995d66a678153e01ed3040f3f4dfc16a0d6b · Note
• https://pypi.python.org · Note
• https://twitter.com/CVEnew/status/1861051444037853302 · Twitter Post
• https://t.me/latest_high_impact_cve/1560 · Telegram Post
• https://github.com/advisories/GHSA-qpgc-w4mg-6v92 · Note