CVE-2024-27134

Summary

CVE-2024-27134 is a vulnerability in MLflow that arises from excessive directory permissions. When the spark_udf() MLflow API is utilized, a local attacker can exploit this issue through a Time of Check to Time of Use (ToCToU) attack, resulting in privilege escalation and elevated system access. The vulnerability is significant because it enables unauthorized users to gain unnecessary privileges, potentially leading to severe security consequences. The issue only affects systems where the MLflow API with spark_udf() is employed.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.