PT-2023-8256 · Nvidia · Nvidia Triton Inference Server

L1K3Beef · Publicado 2023-12-19 · Atualizado 2024-02-19 · CVE-2023-31036

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVIDIA Triton Inference Server (affected versions not specified)

Description The issue is related to errors in processing relative paths to directories during model loading in NVIDIA Triton Inference Server. This can allow a remote attacker to gain unauthorized access to protected information, elevate privileges, execute arbitrary code, or cause a denial of service using the --model-control explicit configuration. The vulnerability can be exploited through the model load API, potentially leading to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Relative Path Traversal

Path traversal

Enumeração de Fraquezas

CWE-23

CWE-22

Identificadores relacionados

BDU:2024-00310

CVE-2023-31036

Produtos afetados

Nvidia Triton Inference Server

Referências · 14

• https://nvidia.custhelp.com/app/answers/detail/a_id/5509 · Aviso do Fabricante
• https://nvidia.com/en-eu/security · Nota
• https://twitter.com/avi_lum/status/1759607228611404203 · Publicação no Twitter
• https://twitter.com/NVIDIAPSIRT/status/1737142206077731118 · Publicação no Twitter
• https://t.me/cvenotify/67282 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-31036 · Aviso do Fabricante
• https://huntr.com/bounties/b27148e3-4da4-4e12-95ae-756d33d94687/?__hstc=79449099.f7d3f20db1bfaa4204b84306ed5e45da.1733330123520.1733330123520.1733330123520.1&__hssc=79449099.3.1733330123520&__hsfp=683428783&_gl=1*h243uw*_ga*MTI1NTA5MDQ4MC4xNzMzMzMwMTEz*_ga_MT9HL3EKXV*MTczMzMzMDExMi4xLjEuMTczMzMzMDY3OC40Mi4wLjE3MjI4MDQ2NTY. · Nota
• https://huntr.com/bounties/b27148e3-4da4-4e12-95ae-756d33d94687/?__hstc=79449099.f7d3f20db1bfaa4204b84306ed5e45da.1733330123520.1733330123520.1733330123520.1&__hssc=79449099.3.1733330123520&__hsfp=683428783&_gl=1*h243uw*_ga*MTI1NTA5MDQ4MC4xNzMzMzMwMTEz*_ga_MT9HL3EKXV*MTczMzMzMDExMi4xLjEuMTczMzMzMDY3OC40Mi4wLjE3MjI4MDQ2NTY. · Nota
• https://twitter.com/VulmonFeeds/status/1745890785612943462 · Publicação no Twitter
• https://t.me/cvenotify/67274 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-31036 · Nota de Segurança
• https://developer.nvidia.com/triton-inference-server · Nota
• https://bdu.fstec.ru/vul/2024-00310 · Nota de Segurança
• https://twitter.com/CVEnew/status/1745860908059165039 · Publicação no Twitter