CyberWatch

Critical Container Flaw Could Impact NVIDIA AI Services

By

Matthew Fagan, Vulnerability Management Patch Analyst

By

Access Point Consulting

Summary

On September 25th, NVIDIA issued a security advisory regarding a critical vulnerability (CVE-2024-0132) in the NVIDIA Container Toolkit. This Time-of-Check Time-of-Use (TOCTOU) flaw allows a specially crafted container image to access the host file system. The vulnerability impacts most AI applications in both cloud and on-prem environments using NVIDIA GPUs.

Impact

This vulnerability can result in:

  • Code execution
  • Denial of service
  • Privilege escalation
  • Information disclosure
  • Data tampering

With a CVSS score of 9.0, it is classified as a high-severity issue.

Affected Versions

NVIDIA Container Toolkit: Versions up to and including 1.16.1 Affected software includes Docker, Kubernetes, Red Hat OpenShift, and VMware vSphere with Tanzu, which utilize the NVIDIA Container Toolkit.

Remediation

Upgrade to NVIDIA Container Toolkit version 1.16.2 or later.

Mitigation

Implement the Container Device Interface (CDI) to enhance security and manageability.

Recommendations

  • Patch: Upgrade to the latest version of the NVIDIA Container Toolkit as soon as possible. Follow NVIDIA's documentation for specific upgrade instructions based on your application.
  • Mitigate: Implement CDI for secure, standardized access to third-party devices within containers.
  • Review: Assess your environment to identify container instances using NVIDIA GPUs to gauge exposure.

Associated Bulletin

Security Bulletin: NVIDIA Container Toolkit - September 2024 | NVIDIA (custhelp.com)

Resources

Trending Articles & Security Reports

Resources

CyberWatch

October 7, 2024

VINs and Losses: How Hackers Take Kias for a Ride

In the age of smart cars and connected devices, convenience often comes with hidden risks. A recently discovered critical vulnerability in Kia vehicles serves as a stark reminder of how our increasingly digital world is making cars new targets for cyberattacks. This vulnerability allowed hackers to remotely control various vehicle functions—using nothing more than a car's license plate number. It highlights the growing threat of cyberattacks on connected cars and the importance of cybersecurity in the automotive industry.

Find out more
October 3, 2024

Vulnerability in SolarWinds Managed File Transfer Server Actively Exploited

CVE-2024-28995 SolarWinds has issued a critical update for a zero-day vulnerability in its Serv-U MFT Server, allowing attackers to bypass security and access restricted files without authentication. Actively exploited, this flaw poses a significant risk for businesses that delay applying the fix.

Find out more
September 30, 2024

Cybersecurity's New Playing Field: Why Sports Organizations Draw Hackers

If hackers follow the Willie Sutton rule — going where the money/data/geopolitical leverage is, then professional sports organizations, or PSOs, represent a kind of perfect storm of motivation.

Find out more