NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host. The name and location of the files cannot be controlled by an attacker. A successful exploit of this vulnerability might lead to data tampering.
Isn't this supposed to be CVE-2024-0132 and CVE-2024-0133, not CVE-2024-0134? References: https://nvidia.custhelp.com/app/answers/detail/a_id/5582 https://github.com/NVIDIA/nvidia-container-toolkit/releases/tag/v1.16.2
(In reply to Debarshi Ray from comment #2) > Isn't this supposed to be CVE-2024-0132 and CVE-2024-0133, not CVE-2024-0134? Never mind. I see that CVE-2024-0134 is a thing: https://nvidia.custhelp.com/app/answers/detail/a_id/5585 https://github.com/NVIDIA/nvidia-container-toolkit/releases/tag/v1.17.0 https://github.com/advisories/GHSA-7jm9-xpwx-v999