CVE-2024-0132: NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
References
- github.com/NVIDIA/gpu-operator/security/advisories/GHSA-95rf-r6p4-44h7
- github.com/NVIDIA/libnvidia-container/security/advisories/GHSA-q2v4-jw5g-9xxj
- github.com/NVIDIA/nvidia-container-toolkit
- github.com/NVIDIA/nvidia-container-toolkit/security/advisories/GHSA-mjjw-553x-87pq
- github.com/advisories/GHSA-mjjw-553x-87pq
- nvd.nist.gov/vuln/detail/CVE-2024-0132
- nvidia.custhelp.com/app/answers/detail/a_id/5582
Code Behaviors & Features
Detect and mitigate CVE-2024-0132 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →