Malicious code loophole in Nvidia Container Toolkit closed
Attackers can exploit vulnerabilities in Nvidia Container Toolkit and GPU Operator to compromise systems.
(Image: Artur Szczybylo/Shutterstock.com)
Among other things, a critical vulnerability makes Nvidia Container Toolkit and GPU Operator under Linux vulnerable to attacks. Security patches are available.
Two gaps closed
With Container Toolkit, admins use the GPU computing power for containers and GPU Operator helps in the Kubernetes context. Both pieces of software are vulnerable via two vulnerabilities (CVE-2024-0132"critical", CVE-2024-0133"moderate"). There are currently no reports of attacks on the security vulnerabilities sealed with software updates. Unfortunately, Nvidia does not provide any details in the vulnerability alert on how admins can identify systems that have already been attacked.
Attackers should be able to exploit the critical gap with a prepared container. If such an attack is successful, the worst-case scenario is that malicious code gets onto PCs. In such cases, systems are usually considered fully compromised. In the second case, attackers can manipulate data.
The developers state that they have closed the vulnerabilities in Container Toolkit v1.16.2 and GPU Operator 24.6.2. All previous versions are under threat.
In addition to less common software such as the Container Toolkit, vulnerabilities are often found in Nvidia's well-known graphics card drivers. In July, Nvidia's developers patched vulnerabilities that could have allowed attackers to infiltrate malicious code.
(des)
