NVIDIA Container Toolkit Vulnerability Allows for File System Access

CVE-2024-0132

Summary

The NVIDIA Container Toolkit versions up to 1.16.1 possess a Time-of-Check Time-of-Use (TOCTOU) vulnerability that arises when the tool is utilized with its default configurations. A specially crafted container image can exploit this vulnerability to gain unauthorized access to the host file system. This situation creates several security concerns, such as unauthorized code execution, potential denial of service, privilege escalation, and possibilities for information disclosure and data tampering. The vulnerability is mitigated when Container Device Interface (CDI) is implemented.

News Articles

The Stack

CVE-2024-0132CVE-2024-29847

October Patch Tuesday: MSFT patches 2 exploited zero days

Microsoft has patched a brace of zero days that are under active attack as part of October Patch Tuesday 2024.

3 months ago

Trend Micro

CVE-2024-0132

NVIDIA AI Container Toolkit Vulnerability Fix

On Wednesday, NVIDIA released updates to fix a critical vulnerability in its NVIDIA Container Toolkit, which, if exploited, could put a wide range of AI infrastructure and underlying data/secrets at risk....

4 months ago

The Register

CVE-2024-0132

Critical Nvidia bug allows container escape, host takeover

A critical bug in Nvidia's widely used Container Toolkit could allow a rogue user or software to escape their containers and ultimately take complete control of the underlying host. The flaw, tracked as...

4 months ago

References