GitHub Advisoryadvisory · Go

GHSA-f748-7hpg-88ch NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system

MEDIUM Published 2024-10-29 Modified 2024-10-29 Official page ↗
Aliases
CVE-2024-0133
Ecosystem
Go
Packages
github.com/NVIDIA/nvidia-container-toolkit
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Weaknesses
CWE-367
Reviewed
2024-10-29

Affected packages

• Go github.com/NVIDIA/nvidia-container-toolkit: < 1.16.2 → fixed in 1.16.2

Description

NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.

Related

Alias · CVE (1)

  • CVE-2024-0133 NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container… vulnerability

Weakness · CWE (1)

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References