Friday, 11 April, 2025

Incomplete Patch in NVIDIA Toolkit Leaves Linux Systems Vulnerable to Container Escapes

A recent analysis by Trend Micro has revealed that NVIDIA's September 2024 patch for the critical CVE-2024-0132 vulnerability in its Container Toolkit was incomplete. This Time-of-Check Time-of-Use (TOCTOU) flaw allows attackers to escape container isolation and execute arbitrary code on the host system. The issue persists in version 1.17.4 when the 'allow-cuda-compat-libs-from-container' feature is enabled.