cbcvebase.
CVE-2024-0132
published 2024-09-26

CVE-2024-0132: NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a…

PriorityP267high8.3CVSS 3.1
AVNACHPRNUIRSCCHIHAH
EXPLOIT
EPSS
37.05%
98.3th percentile
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Affected

11 ranges
VendorProductVersion rangeFixed in
github.comnvidia_nvidia-container-toolkit>= 0 < 1.16.21.16.2
msrcazure_kubernetes_service_node_on_azure_linux
msrcazure_kubernetes_service_node_on_ubuntu_linux
msrcazure_linux_3.0_arm
msrcazure_linux_3.0_x64
msrccbl_mariner_2.0_arm
msrccbl_mariner_2.0_x64
nvidiacontainer_toolkit
nvidiagpu_operator
nvidianvidia_container_toolkit< 1.16.21.16.2
nvidianvidia_gpu_operator< 24.6.224.6.2

Detection & IOCsextracted from sources · hover to see the quote

path/var/lib/docker/overlay2//merged
processnvidia-container-runtime-hook
processnvidia-container-runtime
  • Monitor for symlinks or directories planted at /usr/local/cuda/compat/ matching the glob pattern lib*.so.* inside container images, as the exploit plants directories instead of regular files at this path to manipulate the xglob resolution.
  • Prioritize patching container hosts running NVIDIA Container Toolkit versions ≤1.16.1 that are also pulling images from publicly writable or external/untrusted repositories, as these represent the highest-risk exploitation scenario.
  • The TOCTOU vulnerability is triggered during the prestart OCI hook phase before container security boundaries are fully established; monitor for anomalous filesystem operations (symlink/directory creation under cuda compat paths) occurring during this early container initialization window.
  • CDI (Container Device Interface) mode bypasses the vulnerable code path entirely; environments using CDI (e.g., Podman with native CDI support) are not affected and can be used as a compensating control.
  • ·The vulnerability only affects NVIDIA Container Toolkit when used with default configuration (non-CDI mode). Deployments using CDI are not impacted.
  • ·The original patch for CVE-2024-0132 did not fully resolve the issue; a bypass was separately tracked as CVE-2025-23359. Both are addressed in NVIDIA Container Toolkit version 1.17.4.
  • ·While Docker is the primary focus, Containerd (Kubernetes) and CRI-O runtimes are also affected by CVE-2024-0132; Podman via CDI is not affected.

CVSS provenance

nvdv3.18.3HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
vendor_msrc9.0CRITICAL
vendor_redhat9.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.