1. Home
  2. CVE Database
  3. CVE-2024-0132
CRITICAL · 9.0

CVE-2024-0132

NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access...

Vulnerability Description

NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS Score

9.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
NvidiaNvidia Container Toolkit< 1.16.2
LinuxLinux Kernel-
NvidiaNvidia Gpu Operator< 24.6.2

Related Weaknesses (CWE)

CWE-367

References

FAQ

What is CVE-2024-0132?

CVE-2024-0132 is a vulnerability with a CVSS score of 9.0 (CRITICAL). NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access...

How severe is CVE-2024-0132?

CVE-2024-0132 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2024-0132?

Check the references section above for vendor advisories and patch information. Affected products include: Nvidia Nvidia Container Toolkit, Linux Linux Kernel, Nvidia Nvidia Gpu Operator.