PT-2025-40051 · Go · Github.Com/Nvidia/Gpu-Operator+3

Publicado 2025-07-17 · Atualizado 2025-07-17

OSV

CVSS v3.1

9.0

Crítica

Vetor base

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial of service.

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

GHSA-VMG3-7V43-9G23

Produtos afetados

Github.Com/Nvidia/Gpu-Operator

Github.Com/Nvidia/K8S-Device-Plugin

Github.Com/Nvidia/Mig-Parted

Github.Com/Nvidia/Nvidia-Container-Toolkit

Referências · 12

• https://github.com/NVIDIA/k8s-device-plugin · Nota
• https://github.com/NVIDIA/nvidia-container-toolkit · Nota
• https://github.com/NVIDIA/gpu-operator · Nota
• https://github.com/NVIDIA/mig-parted · Nota
• https://osv.dev/vulnerability/GHSA-vmg3-7v43-9g23 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-23266 · Nota de Segurança
• https://wiz.io/blog/nvidia-ai-vulnerability-cve-2025-23266-nvidiascape · Nota
• https://pkg.go.dev/vuln/GO-2025-3992 · Nota
• https://news.ycombinator.com/item?id=44818412 · Nota
• https://kidbomb.github.io/posts/nvidia-container-escape-cve-2025-23266-part-2 · Nota
• https://nvidia.custhelp.com/app/answers/detail/a_id/5659 · Nota
• https://kidbomb.github.io/posts/nvidia-container-escape-cve-2025-23266 · Nota