CVE-2024-0132

Published Sep 26, 2024

Last updated 7 months ago

NVIDIA Container Toolkit

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2024-0132 is a Time-of-Check Time-of-Use (TOCTOU) vulnerability found in NVIDIA Container Toolkit versions 1.16.1 and earlier. It exists when the toolkit is used with its default configuration. The vulnerability allows a specially crafted container image to gain unauthorized access to the host file system. This vulnerability does not impact use cases where the Container Device Interface (CDI) is used. Successful exploitation of CVE-2024-0132 can lead to several consequences, including code execution, denial of service, privilege escalation, information disclosure, and data tampering. While NVIDIA released a patch in September 2024, it was later found to be incomplete, leaving systems potentially vulnerable to container escape attacks and a related performance flaw affecting Docker on Linux.

Description: NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Source: psirt@nvidia.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.3
Impact score: 6
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-367
psirt@nvidia.com: CWE-367

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:nvidia:nvidia_container_toolkit:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "55455A6E-4257-4750-9A18-8D8A5EA029B7",
            "versionEndExcluding": "1.16.2"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:nvidia:nvidia_gpu_operator:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "28B17317-5E43-4842-BB41-6E459FAD3D40",
            "versionEndExcluding": "24.6.2"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]