Summary
On September 25th, NVIDIA issued a security advisory regarding a critical vulnerability (CVE-2024-0132) in the NVIDIA Container Toolkit. This Time-of-Check Time-of-Use (TOCTOU) flaw allows a specially crafted container image to access the host file system. The vulnerability impacts most AI applications in both cloud and on-prem environments using NVIDIA GPUs.
Impact
This vulnerability can result in:
- Code execution
- Denial of service
- Privilege escalation
- Information disclosure
- Data tampering
With a CVSS score of 9.0, it is classified as a high-severity issue.
Affected Versions
NVIDIA Container Toolkit: Versions up to and including 1.16.1 Affected software includes Docker, Kubernetes, Red Hat OpenShift, and VMware vSphere with Tanzu, which utilize the NVIDIA Container Toolkit.
Remediation
Upgrade to NVIDIA Container Toolkit version 1.16.2 or later.
Mitigation
Implement the Container Device Interface (CDI) to enhance security and manageability.
Recommendations
- Patch: Upgrade to the latest version of the NVIDIA Container Toolkit as soon as possible. Follow NVIDIA's documentation for specific upgrade instructions based on your application.
- Mitigate: Implement CDI for secure, standardized access to third-party devices within containers.
- Review: Assess your environment to identify container instances using NVIDIA GPUs to gauge exposure.
Associated Bulletin
Security Bulletin: NVIDIA Container Toolkit - September 2024 | NVIDIA (custhelp.com)
.webp)
