Container Toolkit / GPU Operator: Unauthorized file creation on the host (data tampering)

CVSS 4.1CVE-2024-0134NVIDIA / GPU stackcurated

Impact

Unauthorized file creation on the host (data tampering)

Who can reach it

Any tenant with a crafted container image

What to do

Bump toolkit; upgrade GPU Operator Helm chart

References

https://github.com/NVIDIA/product-security/tree/main/2024/5585 https://nvd.nist.gov/vuln/detail/CVE-2024-0134

Related entries

Container Toolkit / GPU Operator: Container escape to host root (insufficient input validation)CVE-2024-0135 · Container Toolkit / GPU OperatorHigh
Container Toolkit / GPU Operator: Container escape to host (insufficient input validation)CVE-2024-0136 · Container Toolkit / GPU OperatorHigh
Container Toolkit / GPU Operator: Host DoS / info disclosureCVE-2024-0137 · Container Toolkit / GPU OperatorMedium
Omniverse Launcher: Access-token disclosureCVE-2023-25524 · Omniverse LauncherMedium
CUDA Toolkit: DoS (null deref)CVE-2023-0196 · CUDA ToolkitLow
NVIDIA CUDA Toolkit - cuobjdump: A null-pointer dereference on a malformed binary crashes the toolCVE-2023-25510 · NVIDIA CUDA Toolkit - cuobjdumpLow

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.