TorchServe local privilege escalation via predictable temporary directory
Another user on the same computer can take over TorchServe and hack it.
Summary
TorchServe uses a predictable extraction directory in /tmp, so a local user can swap the model handler and run code as the TorchServe service account. All versions are affected.
Affected when
- Local user account access to the system
What to do
We have not confirmed a fixed version yet. Check the source links below.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen