GHSA-mjjw-553x-87pq
NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/NVIDIA/nvidia-container-toolkit | < 1.16.2 | 1.16.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/NVIDIA/gpu-operator/security/advisories/GHSA-95rf-r6p4-44h7
- https://github.com/NVIDIA/libnvidia-container/security/advisories/GHSA-q2v4-jw5g-9xxj
- https://github.com/NVIDIA/nvidia-container-toolkit/security/advisories/GHSA-mjjw-553x-87pq
- https://nvd.nist.gov/vuln/detail/CVE-2024-0132
- https://github.com/NVIDIA/nvidia-container-toolkit
- https://nvidia.custhelp.com/app/answers/detail/a_id/5582