Undergoing Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
CVE has been recently published to the CVE List and has been received by the NVD.
Products
NVIDIA Container Toolkit
- 1.16.1 or earlier
Source
psirt@nvidia.com
Tags
CVE-2024-0133 details
Published : Sept. 26, 2024, 6:15 a.m.
Last Modified : Sept. 26, 2024, 1:32 p.m.
Last Modified : Sept. 26, 2024, 1:32 p.m.
Description
NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.
CVSS Score
| 1 | 2 | 3 | 4.1 | 5 | 6 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
Base Score
4.1
Exploitability Score
2.3
Impact Score
1.4
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
References
| URL | Source |
|---|---|
| https://nvidia.custhelp.com/app/answers/detail/a_id/5582 | psirt@nvidia.com |
This website uses the NVD API, but is not approved or certified by it.