Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/NVIDIA/nvidia-container-toolkit < 1.17.8
Fixed in
1.17.8· Vendor fix available
Issue
NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial of service.
Recommended action: Upgrade to 1.17.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/NVIDIA/nvidia-container-toolkit < 1.17.8
Fixed in
1.17.8· Vendor fix available
Issue
NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link following by using a specially crafted container image. A successful exploit of this vulnerability might lead to data tampering and denial of service.
Recommended action: Upgrade to 1.17.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/NVIDIA/nvidia-container-toolkit < 1.16.2
Fixed in
1.16.2· Vendor fix available
Issue
NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.
Recommended action: Upgrade to 1.16.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/NVIDIA/nvidia-container-toolkit < 1.16.2
Fixed in
1.16.2· Vendor fix available
Issue
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Recommended action: Upgrade to 1.16.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.