CVE-2024-0132

Description

NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

References

https://aws.amazon.com/security/security-bulletins/AWS-2024-010/

https://www.bleepingcomputer.com/news/security/critical-flaw-in-nvidia-container-toolkit-allows-full-host-takeover/

https://www.thestack.technology/critical-nvidia-container-bug-is-an-old-school-risk-to-ai-workloads/

https://www.theregister.com/2024/09/26/critical_nvidia_bug_container_escape/

https://www.securityweek.com/critical-nvidia-container-flaw-exposes-cloud-ai-systems-to-host-takeover/

https://nvidia.custhelp.com/app/answers/detail/a_id/5582

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3