CRITICAL9.0
GHSA-mjjw-553x-87pq
NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability
Quick fix
GHSA-mjjw-553x-87pq — github.com/NVIDIA/nvidia-container-toolkit: upgrade to the fixed version with the command below.
go get github.com/NVIDIA/nvidia-container-toolkit@v1.16.2Details
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/NVIDIA/nvidia-container-toolkit
Introduced in:
0Fixed in: 1.16.2Fix
go get github.com/NVIDIA/nvidia-container-toolkit@v1.16.2References
- https://github.com/NVIDIA/gpu-operator/security/advisories/GHSA-95rf-r6p4-44h7[WEB]
- https://github.com/NVIDIA/libnvidia-container/security/advisories/GHSA-q2v4-jw5g-9xxj[WEB]
- https://github.com/NVIDIA/nvidia-container-toolkit/security/advisories/GHSA-mjjw-553x-87pq[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2024-0132[ADVISORY]
- https://github.com/NVIDIA/nvidia-container-toolkit[PACKAGE]
- https://nvidia.custhelp.com/app/answers/detail/a_id/5582[WEB]