CVE-2024-0134 Path traversal in NVIDIA Container Toolkit
A crafted container image can create unauthorized files on the host, leading to data tampering in NVIDIA Container Toolkit and GPU Operator.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-0134?
CVE-2024-0134 is a medium-severity path traversal vulnerability in NVIDIA Container Toolkit, published on 5 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host. The name and location of the files cannot be controlled by an attacker. A successful exploit of this vulnerability might lead to data tampering.
Weakness: CWE-61
Which versions are affected by CVE-2024-0134?
It affects 2 products.
Products include Nvidia Nvidia Container Toolkit, Nvidia Nvidia Gpu Operator.
How do I fix CVE-2024-0134?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-0134 being exploited?
There is no known exploitation of CVE-2024-0134 in the wild and no public exploit code.
Other vulnerabilities in NVIDIA Container Toolkit
- CVE-2024-0132 NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability
- CVE-2025-23359 Race condition in Container Toolkit
- CVE-2024-0135 Privilege escalation in NVIDIA Container Toolkit
- CVE-2024-0136 Privilege escalation in NVIDIA Container Toolkit
- CVE-2024-0137 Privilege escalation in NVIDIA Container Toolkit
Sources
Also known as AZL-52393, AZL-52452, GHSA-7jm9-xpwx-v999.