critical9.0Public exploit code
CVE-2024-0132
NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- NVIDIA Container Toolkit 1.16.1 - Time-of-check Time-of-Use (TOCTOU)2025-03-26 · local · linux
Impact
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/NVIDIA/nvidia-container-toolkit | < 1.16.2 | 1.16.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nvidia | Nvidia Container Toolkit | before 1.16.2 |
| Nvidia | Nvidia Gpu Operator | before 24.6.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://nvidia.custhelp.com/app/answers/detail/a_id/5582
- https://github.com/advisories/GHSA-mjjw-553x-87pq
- https://github.com/NVIDIA/gpu-operator/security/advisories/GHSA-95rf-r6p4-44h7
- https://github.com/NVIDIA/libnvidia-container/security/advisories/GHSA-q2v4-jw5g-9xxj
- https://github.com/NVIDIA/nvidia-container-toolkit/security/advisories/GHSA-mjjw-553x-87pq
- https://nvd.nist.gov/vuln/detail/CVE-2024-0132