A critical vulnerability in the NVIDIA Container Toolkit could allow a container to escape and gain full access to the underlying host.<\/h2>\n\n\n\n
Critical vulnerability CVE-2024-0132 (CVSS score 9.0) in the NVIDIA Container Toolkit could allow an attacker to escape the container and gain full access to the underlying host.<\/p>\n\n\n\n
The vulnerability is a Time-of-check Time-of-Use (TOCTOU) issue that impacts NVIDIA Container Toolkit 1.16.1 or earlier. <\/p>\n\n\n\n
“NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system.” reads the advisory<\/a> published by NVIDIA. “This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.”<\/em><\/p>\n\n\n\n
“Wiz Research has uncovered a critical security vulnerability, CVE-2024-0132, in the widely used NVIDIA Container Toolkit, which provides containerized AI applications with access to GPU resources. This impacts any AI application \u2013 in the cloud or on-premise \u2013 that is running the vulnerable container toolkit to enable GPU support.” reads the advisory<\/a> published by Wiz. “The vulnerability enables attackers who control a container image executed by the vulnerable toolkit to escape from that container and gain full access to the underlying host system, posing a serious risk to sensitive data and infrastructure.”<\/em>
![\"NVIDIA](\"https:\/\/i0.wp.com\/securityaffairs.com\/wp-content\/uploads\/2024\/09\/image-36.png?ssl=1\")
<\/a><\/figure>\n\n\n\nBelow are the three stages of the attack detailed by Wiz researchers:<\/p>\n\n\n\n
- \n
- Gaining full access to the file system<\/strong>: Attackers execute a specially designed image to exploit CVE-2024-0132.<\/li>\n\n\n\n
- Attackers gain full read access<\/strong> to the host’s file system. This provides visibility into the infrastructure and potential access to other customers’ confidential data. The attacker could execute the malicious image on the target platform either directly, such as through shared GPU services, or indirectly via supply chain or social engineering attacks.<\/li>\n\n\n\n
- Complete host takeover<\/strong>: Once obtained access to Container Runtime Unix sockets (docker.sock\/containerd.sock), the attacker can execute commands with root privileges, gaining control of the host system. Despite initial read-only access, a Linux socket behavior allows attackers to write commands, exploiting this vulnerability for a full system takeover.
<\/gwmw> <\/gwmw><\/li>\n<\/ul>\n\n\n\n