NVIDIA Container Toolkit Flaw Enables Container Escape and Host Takeover
Summary
Wiz disclosed CVE-2024-0132, which lets an attacker using a malicious container image escape vulnerable NVIDIA Container Toolkit environments and access the host. NVIDIA released fixes; affected users should upgrade.
Key points
- CVE-2024-0132 affects NVIDIA Container Toolkit versions through 1.16.1 and NVIDIA GPU Operator versions through 24.6.1.
- An attacker who can run a specially crafted container image can escape the container and gain read access to the host filesystem.
- The article describes how access to container-runtime Unix sockets could then enable commands on the host with root privileges.
- Shared GPU environments may expose other applications’ data and secrets; the article highlights risks from untrusted images, social engineering, and supply-chain access.
- NVIDIA released Container Toolkit 1.16.2 and GPU Operator 24.6.2 to address the issue. Container Device Interface use is not affected.
- Wiz reported the vulnerability on September 1, 2024; NVIDIA acknowledged it on September 3 and shipped a fix on September 26.
Article Details
- Vulnerability Types
- Container escape
- Severity
- Critical
- Affected Versions
- NVIDIA Container Toolkit versions up to and including v1.16.1
- NVIDIA GPU Operator versions up to and including 24.6.1
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
Vendors
Products
Nvidia Container ToolkitWiz Research has uncovered a critical security vulnerability, CVE-2024-0132, in the widely used NVIDIA Container Toolkit, which provides containerized AI applications with access to GPU resources. This impacts any AINVIDIA GPU Operator The NVIDIA GPU Operator is a Kubernetes operator that automatically deploys and manages the NVIDIA Container Toolkit in Kubernetes clusters. Its widespread adoption in GPU-enabled Kubernetes environments significantly