intelligence_src_d11443da85ea659d49
- Source-provided label
- Publisher RSS metadata
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- Sep 01, 2022 00:00 UTC
- Retrieved
- Oct 14, 2026 03:41 UTC
Synapse Spark LPE
Azure Synapse Analytics is an analytics service for processing data using various runtimes, among them Apache Spark. Synapse provided users the capability to mount Azure File Shares to their Apache Spark Pools via a script called filesharemount.sh that would execute with elevated privileges. This script would mount the File Share to the /synfs directory. There was a race condition in the script where, if successfully exploited, a user could execute the chown command to change the ownership of any directory—including the one containing the filesharemount.sh itself. This enabled a user to execute additional code with root privileges. On its own, the impact of this vulnerability was limited to the user’s own Spark pool, and did not permit cross-tenant access. Following disclosure, Microsoft disabled the ability to mount Azure File Shares to Spark pools, and recommended mounting Data Lake Storage Gen2 or Azure Blob Storage instead.
Reference details
- Source category
- research-report
- First reported
- Sep 01, 2022 00:00 UTC
- Last reported
- Sep 01, 2022 00:00 UTC
- Catalog updated
- Oct 14, 2026 03:41 UTC
- Record ID
02b55af33013ef25a946c61ac1fada7791486a33bc6fc8702cb85adf82f5c7bc
Published indicators
Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
Source observations
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Review source update dates and status
- intelligence_src_d11443da85ea659d49Recent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.