Vulnerability · Published Sep 26, 2024 · Assigned by nvidia
CVE-2024-0132
Critical 9.0
In plain English
A critical-severity security flaw in Container Toolkit from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 40.8% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/NVIDIA/nvidia-container-toolkit | 1.16.2 | GHSA-mjjw-553x-87pq |
| Go | github.com/NVIDIA/nvidia-container-toolkit | 1.16.2 | GO-2024-3239 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NVIDIA | Container Toolkit | All versions up to and including v1.16.1 |
| NVIDIA | GPU Operator | All versions up to and including 24.6.1 |
Weakness: CWE-367 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H