NVIDIA CUDA Toolkit - nvdisasm: A null-pointer dereference on a malformed ELF crashes the disassembler

Impact

A null-pointer dereference on a malformed ELF crashes the disassembler. The realistic exposure is your build and profiling pipeline, not your runtime fleet: anything that automatically disassembles third-party fatbins, vendor kernels or model artifacts is running this parser on attacker-influenced input.

Who can reach it

Local, and requires a user or an automated job to run nvdisasm over an attacker-supplied file. CI jobs that inspect third-party CUDA binaries are the usual path.

What to do

Update the CUDA Toolkit package (bulletin 5577). Cost: effectively zero - userspace SDK only, no driver reload, no node drain, no running-job impact. Rebuild build/CI images and move on.

References