CVE-2024-0134
UNIX Symbolic Link (Symlink) Following (CWE-61)
Summary
NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host. The name and location of the files cannot be controlled by an attacker. A successful exploit of this vulnerability might lead to data tampering.
Impact
This vulnerability could allow an attacker to create unauthorized files on the host system using a specially crafted container image. While the attacker cannot control the name or location of these files, it could potentially lead to data tampering. The impact is primarily on the integrity of the system, with no direct effect on confidentiality or availability.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available for this vulnerability. The patch details indicate that a fix has been added on 2024-11-05, as reported by bugzilla.redhat.com.
Mitigation
1. Apply the available patch as soon as possible. 2. Monitor and restrict access to container creation and management. 3. Implement strict access controls and least privilege principles for users interacting with NVIDIA Container Toolkit and NVIDIA GPU Operator. 4. Regularly audit and monitor file system changes on host systems running these NVIDIA components. 5. Keep NVIDIA Container Toolkit and NVIDIA GPU Operator up to date with the latest security releases.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Timeline
Feedly found the first article mentioning CVE-2024-0134. See article
Feedly estimated the CVSS score as HIGH
Feedly estimated the CVSS score as MEDIUM
NVD published the first details for CVE-2024-0134
A CVSS base score of 4.1 has been assigned.
RedHat CVE advisory released a security advisory (CVE-2024-0134).
EPSS Score was set to: 0.04% (Percentile: 10%)