{"id":"CVE-2024-0133","aliases":["AZL-50181","AZL-50184","EUVD-2024-3026","GHSA-f748-7hpg-88ch","GO-2024-3237","SUSE-SU-2024:3950-1","SUSE-SU-2025:4187-1","SUSE-SU-2026:0558-1","openSUSE-SU-2024:0350-1","openSUSE-SU-2024:14458-1"],"status":"published","title":"NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system","description":"NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.","severity":{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00249,"percentile":0.16354,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367"],"published":"2024-09-26T05:21:33Z","modified":"2026-09-10T03:50:19Z","fixes":[{"ecosystem":"Go","package":"github.com/NVIDIA/nvidia-container-toolkit","fixed_in":["1.16.2"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"nvidia-container-toolkit","fixed_in":["1.16.2-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nvidia-container-toolkit","fixed_in":["1.16.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/NVIDIA/nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/NVIDIA/nvidia-container-toolkit","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/NVIDIA/nvidia-container-toolkit","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241104T154416-150000.1.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241104T154416-150000.1.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241104T154416-150000.1.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241104T154416-150000.1.12.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nvidia-container-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.17.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"libnvidia-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libnvidia-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libnvidia-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libnvidia-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libnvidia-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libnvidia-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libnvidia-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libnvidia-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libnvidia-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libnvidia-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libnvidia-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libnvidia-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.5.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241104T154416-5.1"}]}],"bundled":56},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241104T154416-1.1"}]}],"bundled":9}],"products":[{"vendor":"nvidia","product":"container toolkit"},{"vendor":"nvidia","product":"gpu operator"},{"vendor":"nvidia","product":"nvidia_container_toolkit"},{"vendor":"nvidia","product":"nvidia_gpu_operator"}],"references":[{"url":"https://nvidia.custhelp.com/app/answers/detail/a_id/5582","tags":["Vendor Advisory","web"]},{"url":"https://github.com/NVIDIA/libnvidia-container/security/advisories/GHSA-xff4-h7r9-vrpf","tags":["web"]},{"url":"https://github.com/NVIDIA/nvidia-container-toolkit/security/advisories/GHSA-f748-7hpg-88ch","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0133","tags":["web","advisory"]},{"url":"https://advisory-inbox.githubapp.com/advisory_reviews/GHSA-wqq7-v22c-gpfp","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f748-7hpg-88ch"},{"url":"https://github.com/NVIDIA/nvidia-container-toolkit","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243950-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8185","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254187-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1231032","tags":["report"]},{"url":"https://bugzilla.suse.com/1231033","tags":["report"]},{"url":"https://bugzilla.suse.com/1232855","tags":["report"]},{"url":"https://bugzilla.suse.com/1236496","tags":["report"]},{"url":"https://bugzilla.suse.com/1236497","tags":["report"]},{"url":"https://bugzilla.suse.com/1236498","tags":["report"]},{"url":"https://bugzilla.suse.com/1237085","tags":["report"]},{"url":"https://bugzilla.suse.com/1246614","tags":["report"]},{"url":"https://bugzilla.suse.com/1246860","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23359","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260558-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-33662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9675","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GTXVZRCFTU5PCCCSGHW6XKWTHARICQJE/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-0133","description":"NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.","status":"published","published":"2024-09-26T05:21:33.599Z","modified":"2024-09-26T13:30:42.127Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:34:22.852179Z"}],"euvd":[{"id":"EUVD-2024-3026","description":"NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.","status":"published","published":"2024-09-26T05:21:33Z","modified":"2024-09-26T13:30:42Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:10.432496Z"}],"ghsa":[{"id":"GHSA-f748-7hpg-88ch","title":"NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system","description":"NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.","status":"published","published":"2024-10-29T19:52:41Z","modified":"2024-10-29T19:52:42Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"},{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:38:14.769863Z"}],"nvd":[{"id":"CVE-2024-0133","description":"NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.","status":"published","published":"2024-09-26T06:15:04.053Z","modified":"2026-06-17T06:52:50.78Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:10:29.044588Z"}],"osv":[{"id":"AZL-50181","title":"CVE-2024-0133 affecting package nvidia-container-toolkit for versions less than 1.16.2-1","description":"NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.","status":"published","published":"2024-09-26T06:15:04Z","modified":"2026-04-21T04:50:01.282333Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-50184","title":"CVE-2024-0133 affecting package nvidia-container-toolkit for versions less than 1.16.2-1","description":"NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.","status":"published","published":"2024-09-26T06:15:04Z","modified":"2026-04-21T04:30:09.402176Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"GHSA-f748-7hpg-88ch","title":"NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system","description":"NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.","status":"published","published":"2024-10-29T19:52:41Z","modified":"2026-09-10T03:50:19.683101251Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"GO-2024-3237","title":"NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system in github.com/NVIDIA/nvidia-container-toolkit","description":"NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system in github.com/NVIDIA/nvidia-container-toolkit","status":"published","published":"2024-11-04T15:44:16Z","modified":"2026-02-04T02:58:11.643435Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"openSUSE-SU-2024:0350-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww\n  * GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97\n  * GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r\n  * GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch\n  * GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq\n  * GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw\n  * GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h\n  * GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh\n  * GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj\n\n- Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g\n  * GO-2024-3245 CVE-2024-39720\n  * GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v\n\n- Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm\n  * GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh\n\n- Update to version 0.0.20241030T160108 2024-10-30T16:01:08Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr\n  * GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c\n  * GO-2024-3228 GHSA-wcx9-ccpj-hx3c\n- Packaging improvments:\n  * Backfill CVE aliases in recent changelog entries\n\n- Update to version 0.0.20241028T152002 2024-10-28T15:20:02Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3207 GHSA-p5wf-cmr4-xrwr\n  * GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6\n  * GO-2024-3210 CVE-2024-8901\n  * GO-2024-3211 CVE-2024-50312\n  * GO-2024-3212 GHSA-rjfv-pjvx-mjgv\n  * GO-2024-3213 CVE-2024-49380\n  * GO-2024-3214 CVE-2024-49381\n  * GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7\n  * GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv\n  * GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc\n  * GO-2024-3219 GHSA-7h65-4p22-39j6\n  * GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4\n  * GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc\n  * GO-2024-3222 GHSA-x7xj-jvwp-97rv\n  * GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v\n  * GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r\n\n- Update to version 0.0.20241017T153730 date 2024-10-17T15:37:30Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3203 CVE-2024-9486\n  * GO-2024-3204 CVE-2024-9594\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8\n  * GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc\n  * GO-2024-3199 GHSA-vv6c-69r6-chg9\n  * GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj\n  * GO-2024-3201 CVE-2023-22644\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4\n  * GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3\n  * GO-2024-3163 CVE-2024-47182\n  * GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh\n  * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j\n  * GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52\n  * GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h\n  * GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc\n  * GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4\n  * GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8\n  * GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4\n  * GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x\n  * GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq\n  * GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr\n  * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n  * GO-2024-3182 GHSA-wpr2-j6gr-pjw9\n  * GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m\n  * GO-2024-3185 CVE-2024-47832\n  * GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp\n  * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n  * GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226\n  * GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j","status":"published","published":"2024-11-05T14:52:20Z","modified":"2026-02-04T12:23:04.839834Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:14458-1","title":"govulncheck-vulndb-0.0.20241104T154416-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241104T154416-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-04T00:00:00Z","modified":"2026-02-04T03:08:21.356483Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2024:3950-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww\n  * GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97\n  * GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r\n  * GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch\n  * GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq\n  * GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw\n  * GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h\n  * GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh\n  * GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj\n\n- Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g\n  * GO-2024-3245 CVE-2024-39720\n  * GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v\n","status":"published","published":"2024-11-08T07:57:33Z","modified":"2026-02-05T09:53:39.58165Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2025:4187-1","title":"Security update for nvidia-container-toolkit","description":"This update for nvidia-container-toolkit fixes the following issues:\n\n- Update to version 1.18.0:\n  - This is a major release and includes the following high-level changes:\n    - The default mode of the NVIDIA Container Runtime has been updated to make use\n      of a just-in-time-generated CDI specification instead of defaulting to the legacy mode.\n    - Added a systemd unit to generate CDI specifications for available devices automatically. This allows\n      native CDI support in container engines such as Docker and Podman to be used without additional steps.\n  \n- Security issues fixed:\n  - CVE-2024-0133: Fixed data tampering in host file system via specially\n    crafted container image (bsc#1231032)\n  - CVE-2024-0132: Fixed time-of-check time-of-use (TOCTOU) race condition\n    in default configuration via specifically crafted container image\n    (bsc#1231033)\n  - CVE-2024-0134: Fixed specially-crafted container image can lead to\n    the creation of unauthorized files on the host (bsc#1232855)\n  - CVE-2024-0135: Fixed Improper Isolation or Compartmentalization in\n    NVIDIA Container Toolkit (bsc#1236496)\n  - CVE-2024-0136: Fixed Improper Isolation or Compartmentalization in\n    NVIDIA Container Toolkit (bsc#1236497)\n  - CVE-2024-0137: Fixed Improper Isolation or Compartmentalization in\n    NVIDIA Container Toolkit (bsc#1236498)\n  - CVE-2025-23359: Fixed TOCTOU Vulnerability in NVIDIA Container Toolkit\n    (bsc#1237085)\n  - CVE-2025-23267: Fixed link following can lead to container escape\n    (bsc#1246614)\n  - CVE-2025-23266: Fixed hook initialization might lead to escalation\n    of privileges (bsc#1246860)\n","status":"published","published":"2025-11-24T07:58:47Z","modified":"2026-03-23T04:51:27.139721Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2026:0558-1","title":"Security update for libnvidia-container","description":"This update for libnvidia-container fixes the following issues:\n\nUpdate to version 1.18.0.\n\nSecurity issues fixed:\n\n- CVE-2024-0132: time-of-check time-of-use (TOCTOU) race condition in default configuration via specifically\n  crafted container image (bsc#1231033).\n- CVE-2024-0133: data tampering in host file system via specially crafted container image (bsc#1231032).\n\nOther updates and bugfixes:\n\n- updated to 1.18.0\n  \n  - Add clock_gettime to allowed syscalls\n  - Fix pointer accessing local variable out of scope\n  - Require version match between libnvidia-container-tools and libnvidia-container1\n  - Add libnvidia-gpucomp.so to the list of compute libs\n  - Use VERSION_ prefix for version parts in makefiles\n  - Add additional logging\n  - Do not discard container flags when --cuda-compat-mode is not specified\n  - Remove unneeded --no-cntlibs argument from list command\n  - Add cuda-compat-mode flag to configure command\n  - Skip files when user has insufficient permissions\n  - Fix building with Go 1.24\n  - Add no-cntlibs CLI option to nvidia-container-cli\n  - Fix always using fallback\n  - Add fallback for systems without memfd_create()\n  - Create virtual copy of host ldconfig binary before calling fexecve()\n  - Fix some typos in text.\n\n- update nvidia modprobe to expected 550.54.14.\n- remove services\n","status":"published","published":"2026-02-16T11:42:25Z","modified":"2026-03-23T04:51:37.907119Z","updated_at":"2026-11-02T15:54:00.846737Z"}]}}