PT-2024-7979 · Nvidia · Nvidia Nemo

Ryan Tracey · Published 2024-10-14 · Updated 2024-11-08 · CVE-2024-0129

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVIDIA NeMo versions up to r2.0.0rc0

Description The issue is related to the SaveRestoreConnector function in NVIDIA NeMo, which is associated with incorrect restriction of the directory path name with limited access. Exploitation of this issue may allow an attacker to execute arbitrary code using specially crafted tar files. This can lead to code execution and data tampering.

Recommendations For NVIDIA NeMo versions up to r2.0.0rc0, update to a patched version to resolve the issue. As a temporary workaround, consider restricting the use of the SaveRestoreConnector function to minimize the risk of exploitation. Avoid using unsafe .tar file extraction in the SaveRestoreConnector function until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-09492

CVE-2024-0129

Affected Products

Nvidia Nemo

References · 13

• https://nvidia.custhelp.com/app/answers/detail/a_id/5580 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09492 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0129 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0129 · Security Note
• https://t.me/cvedetector/7883 · Telegram Post
• https://twitter.com/NVIDIAPSIRT/status/1846324825138266240 · Twitter Post
• https://twitter.com/oktsec/status/1846093055411065289 · Twitter Post
• https://twitter.com/Eth1calHackrZ/status/1847510490424934606 · Twitter Post
• https://t.me/cvenotify/101065 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1846173419131343211 · Twitter Post
• https://t.me/zerodayalert/370 · Telegram Post
• https://twitter.com/CVEnew/status/1846066385857683499 · Twitter Post
• https://t.me/cvenotify/98027 · Telegram Post