CVE-2024-0132

CVE Enrichment

CVSS: 8.3 HIGH
EPSS: 40.84%
EPSS Percentile: 98.64%
CISA KEV: Not listed

Description

NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: psirt@nvidia.com
Published: 26-Sep-2024 13:15
Last Modified: 17-Jun-2026 13:52
EPSS Date: 2026-10-16
CWE: CWE-367

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:R /
                            S:C /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

nvidia / nvidia_container_toolkit
Version / affected range: * · before (exclusive) 1.16.2
cpe:2.3:a:nvidia:nvidia_container_toolkit:*:*:*:*:*:*:*:*
nvidia / nvidia_gpu_operator
Version / affected range: * · before (exclusive) 24.6.2
cpe:2.3:a:nvidia:nvidia_gpu_operator:*:*:*:*:*:*:*:*

References

psirt@nvidia.com

Last enrichment sync: 18-Oct-2026 00:01
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (5)

time we've uncovered severe vulnerabilities in this core component. Last year, Wiz Research disclosed CVE-2024-0132, a similar container escape flaw that allowed for a full host takeover. These findings are part of our NVIDIA Container Toolkit Flaw Enables Root-Level Container Escape
CVE-2024-0132 – A critical NVIDIA AI vulnerability affecting over 35% of cloud environments. Wiz Report Finds Rapid Growth in Cloud AI Adoption and Persistent Security Risks
In September of last year, Wiz Research uncovered a critical security vulnerability, tracked as CVE-2024-0132, in the widely used NVIDIA Container Toolkit, which provides containerized AI applications with access to GPU Wiz Details NVIDIA Container Toolkit Flaw Enabling Host Escape
CVE-2024-0132 presented high risk to AI workloads and environments. Wiz AMA Recap: Key Container and Kubernetes Security Challenges
Wiz Research has uncovered a critical security vulnerability, CVE-2024-0132, in the widely used NVIDIA Container Toolkit, which provides containerized AI applications with access to GPU resources. This impacts any AI NVIDIA Container Toolkit Flaw Enables Container Escape and Host Takeover

CVE (2)

People (8)

MITRE ATT&CK (3)

Vendors (6)

Products (14)

Tools (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.