CVE-2024-0132
CRITICALNVIDIA Container Toolkit < 1.16.2 - Time-of-check Time-of-use Race Condition
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2024-0132. PoCs published by r0binak, ssst0n3.
AI-analyzed exploit summary This PoC exploits a TOCTOU vulnerability in NVIDIA Container Toolkit 1.16.1 or earlier, allowing container breakout and host filesystem access via crafted symlinks in a Docker image. The exploit leverages directory traversal to expose host files within the container.
Description
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Exploits (3)
This PoC exploits a TOCTOU vulnerability in NVIDIA Container Toolkit 1.16.1 or earlier, allowing container breakout and host filesystem access via crafted symlinks in a Docker image. The exploit leverages directory traversal to expose host files within the container.
This PoC exploits a TOCTOU (Time-of-Check to Time-of-Use) vulnerability in the NVIDIA container toolkit by manipulating symbolic links in `/usr/local/cuda/compat/` to achieve path traversal and mount the host filesystem. The Dockerfile demonstrates the exploit by creating a malicious container image that bypasses path resolution checks.
This repository contains a functional exploit PoC for CVE-2024-0132, targeting NVIDIA container toolkit to achieve container escape via symlink manipulation and Docker socket access. The exploit demonstrates host file access and Docker API interaction from within a container.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H