NVIDIA Container Toolkit/GPU Operator Privilege Escalation via Container Image (CVE-2024-0134)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - CVE ID: CVE-2024-0134 - Description: NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability in which a specially crafted container image can create unauthorized files on the host. The name and location of the files cannot be controlled by the attacker. Successful exploitation of this vulnerability may lead to data tampering. 2. Vulnerability Impact: - Vector: AV:N/AC:L/PR:L/UI:R/S:C/N/I:L/A:N - Base Score: 4.1 - Severity: Medium - CWE: CWE-61 - Impact: Data tampering 3. Security Update: - Affected Products: NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux - Affected Versions: All versions, including v1.16.2 and 24.6.2 - Updated Versions: v1.17 and 24.9.0 4. Security Update Description: - The security update includes a fix for the CVE-2024-0134 vulnerability. 5. Security Update Installation Instructions: - Detailed instructions for installing the update can be found in the NVIDIA Container Toolkit documentation and NVIDIA GPU Operator documentation. 6. Security Update Notifications: - Subscribe to security update notifications. - View the NVIDIA security update list. - Report potential security issues on the NVIDIA support page. - Learn about the NVIDIA Product Security Incident Response Team (PSIRT) vulnerability management process. 7. Disclaimer: - All information and documentation (including materials) provided by NVIDIA are offered "as is" without any express or implied warranties, including but not limited to warranties of merchantability, fitness for a particular purpose, or non-infringement. 8. Contact Information: - For any questions regarding security updates, contact NVIDIA Support. This information helps users understand and respond to the security vulnerability in NVIDIA Container Toolkit and NVIDIA GPU Operator.

Goal Reached Thanks to every supporter — we hit 100%!

NVIDIA Container Toolkit/GPU Operator Privilege Escalation via Container Image (CVE-2024-0134)