CVE-2024-0134

EUVD-2024-15933
NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host. The name and location of the files cannot be controlled by an attacker. A successful exploit of this vulnerability might lead to data tampering.
Symlink
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.1 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 29%
Affected Products (NVD)
VendorProductVersion
nvidianvidia_container_toolkit
𝑥
< 1.17
nvidianvidia_gpu_operator
𝑥
< 24.9.0
𝑥
= Vulnerable software versions
Azure Linux logo
Azure Linux Releases
Azure Package
Release
nvidia-container-toolkit
Azure Linux 3.0
0:1.17.1-1.azl3
fixed
CBL-Mariner 2.0
0:1.17.1-1.cm2
fixed
Common Weakness Enumeration
References
https://nvidia.custhelp.com/app/answers/detail/a_id/5585