Описание
A flaw was found in Hugging Face Datasets through 5.00 in Extractor.extract(). When archive contents are extracted to predictable output paths, the extractor follows pre-planted symlinks instead of confining writes to the intended directory. A local attacker who can place those symlinks can redirect extraction and overwrite arbitrary files, impacting integrity and availability (including possible privilege escalation or code execution in shared-cache setups).
Отчет
Datasets is vulnerable to symlink following during archive extraction in Extractor.extract(). A local attacker with low privileges who can pre-plant symlinks at predictable output paths, and who can induce extraction (user interaction), may overwrite arbitrary filesystem locations. Fixed after Datasets 5.00 (commit ad2d853).
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Fix deferred | ||
| Lightspeed Core | lightspeed-core/lightspeed-stack-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaii/model-opt-cuda-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/model-opt-cuda-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/vllm-rocm-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/vllm-spyre-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaii/vllm-rocm-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaii/vllm-spyre-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-aws-cuda-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-azure-cuda-rhel9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
6.6 Medium
CVSS3
Связанные уязвимости
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in shared-cache environments, enabling overwrite of sensitive files and potential privilege escalation or code execution.
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in shared-cache environments, enabling overwrite of sensitive files and potential privilege escalation or code execution.
6.6 Medium
CVSS3