CVE-2024-0133

Published: Sep 26, 2024Modified: Oct 2, 2024

3.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N

Exploitability: 1.6 / Impact: 1.4

Source: NVD

Description

NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.

Affected (2)

Products: Nvidia: Nvidia Container Toolkit, Nvidia Gpu Operator

2 products

Nvidia Container Toolkit

Nvidia Gpu Operator

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nvidia Nvidia Container Toolkit	Before 1.16.2

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Nvidia Nvidia Gpu Operator	Before 24.6.2

Running on/with	Platform Versions
Linux Linux Kernel	All versions

Related CWEs

Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

References (1)

https://nvidia.custhelp.com/app/answers/detail/a_id/5582

Source: psirt@nvidia.com

Vendor Advisory

Timeline

No history available yet.