Nvidia: race condition

Critical9.0CVE-2024-0132 · Published Oct 8, 2024

### Description NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. ### Patches The fix has been addressed in [`v1.16.2`](https://github.com/NVIDIA/libnvidia-container/releases/tag/v1.16.2) of the `libnvidia-container*` packages that are bundled with the [NVIDIA Container Toolkit v1.16.2](https://github.com/NVIDIA/nvidia-container-toolkit/releases/tag/v1.16.2). NVIDIA GPU Operator 24.6.2 supports NVIDIA Container Toolkit v1.16.2 and uses it by default. ### References * https://nvidia.custhelp.com/app/answers/detail/a_id/5582