Every CVE Search/ Get API key

CVE-2024-0137

NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted...

5.5 Medium

NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the host’s network namespace. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to denial of service and escalation of privileges.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.33%Up 0.3 points since Jan 28, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.5

NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the host’s network namespace. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to denial of service and escalation of privileges.

Record
CVE-2024-0137
CVSS 3.1
5.5 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-653
Updated
2026-11-02
EUVDEUVD-2024-15936 5.5

NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the host’s network namespace. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to denial of service and escalation of privileges.

Record
EUVD-2024-15936
CVSS 3.1
5.5 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-frhw-w3wm-6cw4 5.5

NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted...

NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the host’s network namespace. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to denial of service and escalation of privileges.

Record
GHSA-frhw-w3wm-6cw4
CVSS 3.1
5.5 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-653
Updated
2026-11-02
NVD 5.5

NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the host’s network namespace. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to denial of service and escalation of privileges.

Record
CVE-2024-0137
CVSS 3.1
5.5 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Weakness
CWE-653
Updated
2026-11-02
OSVSUSE-SU-2025:4187-1 No score

Security update for nvidia-container-toolkit

This update for nvidia-container-toolkit fixes the following issues:

  • Update to version 1.18.0:

    • This is a major release and includes the following high-level changes:
      • The default mode of the NVIDIA Container Runtime has been updated to make use of a just-in-time-generated CDI specification instead of defaulting to the legacy mode.
      • Added a systemd unit to generate CDI specifications for available devices automatically. This allows native CDI support in container engines such as Docker and Podman to be used without additional steps.

  • Security issues fixed:

    • CVE-2024-0133: Fixed data tampering in host file system via specially crafted container image (bsc#1231032)
    • CVE-2024-0132: Fixed time-of-check time-of-use (TOCTOU) race condition in default configuration via specifically crafted container image (bsc#1231033)
    • CVE-2024-0134: Fixed specially-crafted container image can lead to the creation of unauthorized files on the host (bsc#1232855)
    • CVE-2024-0135: Fixed Improper Isolation or Compartmentalization in NVIDIA Container Toolkit (bsc#1236496)
    • CVE-2024-0136: Fixed Improper Isolation or Compartmentalization in NVIDIA Container Toolkit (bsc#1236497)
    • CVE-2024-0137: Fixed Improper Isolation or Compartmentalization in NVIDIA Container Toolkit (bsc#1236498)
    • CVE-2025-23359: Fixed TOCTOU Vulnerability in NVIDIA Container Toolkit (bsc#1237085)
    • CVE-2025-23267: Fixed link following can lead to container escape (bsc#1246614)
    • CVE-2025-23266: Fixed hook initialization might lead to escalation of privileges (bsc#1246860)
Record
SUSE-SU-2025:4187-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nvidia-container-toolkit
SUSE:Linux Enterprise Module for Containers 15 SP6
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1
nvidia-container-toolkit
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1
nvidia-container-toolkit
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1
nvidia-container-toolkit
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1
nvidia-container-toolkit
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1
nvidia-container-toolkit
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1
nvidia-container-toolkit
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1
nvidia-container-toolkit
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1
nvidia-container-toolkit
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1
nvidia-container-toolkit
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1
Show 5 moreShow less
Affected packages
PackageAffectedFixed
nvidia-container-toolkit
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1
nvidia-container-toolkit
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1
nvidia-container-toolkit
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1
nvidia-container-toolkit
SUSE:Enterprise Storage 7.1
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1
nvidia-container-toolkit
openSUSE:Leap 15.6
From an advisory covering 9 CVEs
 before 1.18.0-150200.5.17.1
1.18.0-150200.5.17.1

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-0137 is a medium vulnerability (CVSS 5.5) in Nvidia Container Toolkit, published January 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. No source names a fixed version.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open