NVIDIA CUDA Toolkit, nvJPEG library: Out-of-bounds read/write in nvJPEG while decoding an image, rated code-execution
Impact
Out-of-bounds read/write in nvJPEG while decoding an image, rated code-execution capable. nvJPEG sits in exactly the place you feed untrusted data: GPU-accelerated image decode in training and inference pipelines, DALI preprocessing, and media services. If your ingest path decodes user-uploaded JPEGs on the GPU, this is remote code execution reachable by whoever can upload an image.
Who can reach it
Anyone who can get a malformed JPEG into a pipeline that decodes with nvJPEG - typically an unauthenticated uploader, several hops upstream of the GPU.
What to do
Upgrade the CUDA Toolkit to 11.1.1 or later. The real cost is not the host install: every container image, wheel, conda package and vendored build that statically carries the affected library has to be rebuilt and re-pushed, and running jobs restarted onto the new image. No driver reload, no node drain, no firmware flash - but a full image-fleet rebuild.
References
Related entries
- NVIDIA GPU Display Driver (Windows nvlddmkm.sys + Linux nvidia.ko): User-mode clients can reach legacy privileged APIsCVE-2021-1052 · NVIDIA GPU Display Driver (Windows nvlddmkm.sys + Linux nvidia.ko)High
- NVIDIA vGPU Manager (vGPU plugin): The vGPU plugin lets guests allocate resources they are not authorised to holdCVE-2021-1057 · NVIDIA vGPU Manager (vGPU plugin)High
- NVIDIA vGPU Manager (vGPU plugin): Unvalidated guest index leads to integer overflow in the host plugin, then tamperingCVE-2021-1059 · NVIDIA vGPU Manager (vGPU plugin)High
- NVIDIA vGPU Manager (vGPU plugin): Unvalidated offset produces a buffer overread in the host plugin. A tenant readsCVE-2021-1063 · NVIDIA vGPU Manager (vGPU plugin)High
- NVIDIA vGPU Manager (vGPU plugin): Unvalidated guest input in the vGPU Manager plugin giving host informationCVE-2021-1080 · NVIDIA vGPU Manager (vGPU plugin)High
- NVIDIA vGPU software (guest kernel-mode driver + vGPU plugin): Unvalidated length across the guest kernel-mode driverCVE-2021-1081 · NVIDIA vGPU software (guest kernel-mode driver + vGPU plugin)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.