NVIDIA CV-CUDA: A long-running CV-CUDA Python process consumes resources without bound, ending in denial of service
CVSS 6.1CVE-2024-0115NVIDIA / GPU stackcurated
Impact
A long-running CV-CUDA Python process consumes resources without bound, ending in denial of service and data loss. On a shared inference node this means one tenant's preprocessing job can starve the box.
Who can reach it
Local, low privileges - a user able to submit work through the CV-CUDA Python API.
What to do
Update CV-CUDA per bulletin 5560 and rebuild affected images. Cost: package update and job restart; no driver or firmware change. Consider cgroup memory limits on preprocessing containers as a standing control.
References
Related entries
- NVIDIA DGX A100 - SBIOS / SMM firmware: A privileged user can disable SPI flash write protection during the Pre-EFICVE-2022-42285 · NVIDIA DGX A100 - SBIOS / SMM firmwareMedium
- DGX-2 SBIOS: OOB write in BIOSCVE-2022-42286 · DGX-2 SBIOSMedium
- DGX-2 BMC: Path traversalCVE-2022-42287 · DGX-2 BMCMedium
- NVIDIA DGX-1 - SBIOS / SMM firmware: A flaw in the Bds phase reaches firmware code execution and privilege escalationCVE-2023-25509 · NVIDIA DGX-1 - SBIOS / SMM firmwareMedium
- vGPU software (Virtual GPU Manager): Host-side DoS (null deref in vGPU Manager)CVE-2023-31026 · vGPU software (Virtual GPU Manager)Medium
- NVIDIA GPU secure microcontroller: incorrect permissions let privileged local access modify protected memoryCVE-2026-47518 · NVIDIA GPU secure microcontroller (permission assignment for protected memory)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.