Vulnerability · Published Jan 12, 2024 · Assigned by nvidia

CVE-2023-31036CVE

High 7.5

In plain English

A high-severity security flaw in Triton Inference Server from nvidia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.9%top 41.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option --model-control explicit, an attacker may use the model load API to cause a relative path traversal. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Affected products (as reported)

Vendor	Product	Versions
nvidia	Triton Inference Server	All versions prior to 2.40

Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5509