← Back

CVE-2024-0134

nvd nist
Published: Nov 5, 2024Modified: Nov 8, 2024

JSON object

Loading...
4.1
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Exploitability: 2.3 / Impact: 1.4
Source: NVD

Description

NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host. The name and location of the files cannot be controlled by an attacker. A successful exploit of this vulnerability might lead to data tampering.

Affected (2)

Nvidia
2 products
Nvidia Container Toolkit
Nvidia Gpu Operator
Configuration A
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Nvidia Container Toolkit
Before 1.17
Nvidia Gpu Operator
Before 24.9.0
Running on/withPlatform Versions
Linux
Linux Kernel
All versions

Related CWEs

CWE-61
UNIX Symbolic Link (Symlink) Following
The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

References (1)

Source: psirt@nvidia.com
Vendor Advisory

Timeline

No history available yet.