NVIDIA CUDA Toolkit - cuobjdump: out-of-bounds reads parsing malformed input files

CVSS 5.3CVE-2023-25512NVIDIA / GPU stack+2 more CVEscurated

Impact

A malformed fatbin or object file fed to cuobjdump triggers an out-of-bounds read that can reach limited code execution and information disclosure. NVIDIA split this across 3 ids (CVE-2023-25512/25513/25514) for separate read paths in the same parser, all at CVSS 5.3. Exposure is the build and profiling pipeline rather than the runtime fleet: anything that automatically disassembles third-party fatbins, vendor kernels or model artifacts is running this parser on attacker-influenced input.

Who can reach it

Local, and requires a user or an automated job to run cuobjdump over an attacker-supplied file. CI jobs that inspect third-party CUDA binaries are the usual path.

What to do

Update the CUDA Toolkit package per bulletin 5456 - one update closes all three. Cost: effectively zero, userspace SDK only, no driver reload, no node drain, no running-job impact. Rebuild build/CI images and move on.

Also covers 2 CVEs

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

CVE-2023-25513CVE-2023-25514

References

https://nvd.nist.gov/vuln/detail/CVE-2023-25512 https://github.com/NVIDIA/product-security/tree/main/2023/5456

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.