VDB
Sign up
CRITICAL9.0

GHSA-vmg3-7v43-9g23

NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path

Quick fix

GHSA-vmg3-7v43-9g23 — github.com/NVIDIA/nvidia-container-toolkit: upgrade to the fixed version with the command below.

go get github.com/NVIDIA/nvidia-container-toolkit@v1.17.8

Details

NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial of service.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/NVIDIA/nvidia-container-toolkit
Introduced in: 0Fixed in: 1.17.8
Fixgo get github.com/NVIDIA/nvidia-container-toolkit@v1.17.8
Go/github.com/NVIDIA/k8s-device-plugin
Introduced in: 0Fixed in: 0.17.3
Fixgo get github.com/NVIDIA/k8s-device-plugin@v0.17.3
Go/github.com/NVIDIA/gpu-operator
Introduced in: 0Fixed in: 25.3.2
Fixgo get github.com/NVIDIA/gpu-operator@v25.3.2
Go/github.com/NVIDIA/mig-parted
Introduced in: 0Fixed in: 0.12.2
Fixgo get github.com/NVIDIA/mig-parted@v0.12.2

References