PT-2024-7904 · Nvidia+2 · Nvidia Gpu Operator+3
Andres Riancho
+2
·
Published
2024-11-05
·
Updated
2025-11-24
·
CVE-2024-0134
CVSS v3.1
4.1
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
NVIDIA Container Toolkit versions prior to the fixed version
NVIDIA GPU Operator versions prior to the fixed version
Description
The issue is related to errors in processing symbolic links, which can be exploited by a remote attacker to impact data integrity. A specially crafted container image can lead to the creation of unauthorized files on the host, although the name and location of these files cannot be controlled by the attacker. This might result in data tampering.
Recommendations
For NVIDIA Container Toolkit versions prior to the fixed version, update to the latest version as outlined in the remediation guide.
For NVIDIA GPU Operator versions prior to the fixed version, update to the latest version as outlined in the remediation guide.
As a temporary workaround, consider restricting access to the vulnerable components until a patch is available.
Review security configurations to minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nvidia Container Toolkit
Nvidia Gpu Operator
Red Os
Suse