PT-2023-8256 · Nvidia · Nvidia Triton Inference Server

L1K3Beef · Published 2023-12-19 · Updated 2024-02-19 · CVE-2023-31036

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVIDIA Triton Inference Server (affected versions not specified)

Description The issue is related to errors in processing relative paths to directories during model loading in NVIDIA Triton Inference Server. This can allow a remote attacker to gain unauthorized access to protected information, elevate privileges, execute arbitrary code, or cause a denial of service using the --model-control explicit configuration. The vulnerability can be exploited through the model load API, potentially leading to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

BDU:2024-00310

CVE-2023-31036

Affected Products

Nvidia Triton Inference Server

References · 14

• https://nvidia.custhelp.com/app/answers/detail/a_id/5509 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31036 · Security Note
• https://bdu.fstec.ru/vul/2024-00310 · Security Note
• https://nvidia.com/en-eu/security · Note
• https://twitter.com/avi_lum/status/1759607228611404203 · Twitter Post
• https://twitter.com/NVIDIAPSIRT/status/1737142206077731118 · Twitter Post
• https://t.me/cvenotify/67282 · Telegram Post
• https://huntr.com/bounties/b27148e3-4da4-4e12-95ae-756d33d94687/?__hstc=79449099.f7d3f20db1bfaa4204b84306ed5e45da.1733330123520.1733330123520.1733330123520.1&__hssc=79449099.3.1733330123520&__hsfp=683428783&_gl=1*h243uw*_ga*MTI1NTA5MDQ4MC4xNzMzMzMwMTEz*_ga_MT9HL3EKXV*MTczMzMzMDExMi4xLjEuMTczMzMzMDY3OC40Mi4wLjE3MjI4MDQ2NTY. · Note
• https://huntr.com/bounties/b27148e3-4da4-4e12-95ae-756d33d94687/?__hstc=79449099.f7d3f20db1bfaa4204b84306ed5e45da.1733330123520.1733330123520.1733330123520.1&__hssc=79449099.3.1733330123520&__hsfp=683428783&_gl=1*h243uw*_ga*MTI1NTA5MDQ4MC4xNzMzMzMwMTEz*_ga_MT9HL3EKXV*MTczMzMzMDExMi4xLjEuMTczMzMzMDY3OC40Mi4wLjE3MjI4MDQ2NTY. · Note
• https://twitter.com/VulmonFeeds/status/1745890785612943462 · Twitter Post
• https://t.me/cvenotify/67274 · Telegram Post
• https://developer.nvidia.com/triton-inference-server · Note
• https://twitter.com/CVEnew/status/1745860908059165039 · Twitter Post