Database/AI/ML frameworks & serving
NVIDIA OpenShell: sandbox escape lets confined code run outside the sandbox
Impact
Code running inside an OpenShell sandbox can break out of it, which NVIDIA says may lead to code execution, privilege escalation, data tampering and information disclosure. The score carries a scope change (CVSS:3.1 S:C), so the escape crosses the confinement boundary rather than staying inside it. The sandbox is the only thing standing between untrusted agent workloads and the host that runs them, so on a GPU node an escape puts the serving process, its mounted data and its GPU devices in reach of whoever supplied the workload. Where several tenants' agent sessions land on the same node, this is a tenant-to-tenant exposure, not just a self-inflicted one.
Who can reach it
Network reachable with low-privilege authentication (CVSS AV:N/PR:L): anyone who can get code into an OpenShell sandbox, which on a normal deployment is any user or agent session allowed to run workloads there.
What to do
Update OpenShell to v0.0.34 per NVIDIA bulletin 5872, which lists versions 0 through 0.0.33 as affected on all platforms and directs operators to clone or update from the NVIDIA/OpenShell GitHub repository. This is a userspace redeploy and service restart; nothing in the advisory requires draining or rebooting nodes.
References
Related entries
- scikit-learn / joblib: `joblib.load()` executes commands from an untrusted file via `__reduce__`CVE-2020-13092 · scikit-learn / joblibCritical
- PyTorch (`torch.jit.annotations.parse_type_line`): Arbitrary code execution via unsafe `eval` in TorchScript typeCVE-2022-45907 · PyTorch (`torch.jit.annotations.parse_type_line`)Critical
- MLflow: Path traversal prior to 2.3.1CVE-2023-2780 · MLflowCritical
- LangChain (`LLMMathChain`): Prompt injectionCVE-2023-29374 · LangChain (`LLMMathChain`)Critical
- LangChain (PALChain): Arbitrary code execution via `os.system`/`exec` in generated codeCVE-2023-36258 · LangChain (PALChain)Critical
- LangChain (`load_prompt`): Arbitrary code execution from a JSON prompt fileCVE-2023-36281 · LangChain (`load_prompt`)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.