NVIDIA Container Toolkit Vulnerability Could Lead to Data Tampering
CVE-2024-0133

3.4LOW

Key Information:

Vendor
Nvidia
Status
Container Toolkit
Gpu Operator
Vendor
CVE Published:
26 September 2024

Summary

NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.

Affected Version(s)

Container Toolkit Linux All versions up to and including v1.16.1

GPU Operator Linux All versions up to and including 24.6.1

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5582

CVSS V3.1

Score:
3.4
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.