NVIDIA Container Toolkit Vulnerability Let Attackers Execute Code

Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Researchers from Wiz Research noted that CVE-2025-23359 bypasses an earlier vulnerability, CVE-2024-0132, which was patched in September 2024 , however, some security gaps remained. NVIDIA credits researchers from Wiz Research Andres Riancho, Ronen Shustin, and Shir Tamari and Lei Wang for identifying this vulnerability. This vulnerability tracked as CVE-2025-23359, is categorized as a Time-of-Check Time-of-Use (TOCTOU) flaw with a CVSS v3.1 base score of 8.3 (High). Users are advised to update affected software immediately, validate container images using checksum verification, and avoid enabling deprecated features unless absolutely necessary. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. It allows a maliciously crafted container image to exploit a race condition, gaining unauthorized access to the host file system. Alternatively, applications requiring CUDA Forward Compatibility can set the LD_LIBRARY_PATH environment variable to include /usr/local/cuda/compat, though this may lead to portability issues across driver versions. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 14 Feb 2025 13:35:14 +0000


Cyber News related to NVIDIA Container Toolkit Vulnerability Let Attackers Execute Code

The Art and Science of Container Security - As the adoption of containers accelerates, so does the imperative for robust container security strategies. The interconnected realms of containers and the cloud have given rise to innovative security patterns designed to address the unique ...
1 year ago Feeds.dzone.com
What Is Container Security? Definition, Benefits, and Risks - Container security is a vital factor for all companies that use containers for running their software, as an alternative to using virtual machines. Container security is a total of policies and tools that are applied to maintain a container running ...
2 years ago Heimdalsecurity.com
The state of container security: 5 key steps to locking down your releases - Over the last couple of years, the rise in software supply chain attacks has increased container security risks - and heightened the need for organizations to deploy controls for managing and mitigating those risks. As containers have become ...
1 year ago Securityboulevard.com
Implementing container security best practices using Wazuh - This article will explore how Wazuh helps implement best security practices for containerized environments. Wazuh is a free, open source security platform that offers unified XDR and SIEM capabilities across workloads in cloud and on-premises ...
10 months ago Bleepingcomputer.com
'Leaky Vessels' Cloud Bugs Allow Container Escapes Globally - One of the vulnerabilities, designated as CVE-2024-21626, impacts runC, the lightweight container runtime for Docker and other container environments. It is the most urgent of the four vulnerabilities, with a severity score of 8.6 out of a possible ...
1 year ago Darkreading.com
A Handbook for Managing Containers on Amazon Web Services - Container management is a way to help you create, govern, and maintain your containers. There are tools and services available that can automate the creation, deployment, maintenance, scaling, and monitoring of application or system containers. In ...
2 years ago Trendmicro.com
Nvidia sued after video call mistake showed 'stolen' data - According to a lawsuit filed against tech giant Nvidia, senior staff member Mohammad Moniruzzaman made this error with disastrous consequences. In the course of it, Valeo claims he accidentally displayed a file proving he stole its tech secrets. The ...
1 year ago Bbc.com
10 reasons why securing software supply chains needs to start with containers - Containers and Kubernetes are table stakes for multi-cloud app development, and they're also among the least protected of any areas of software supply chains. Kubernetes commands 92% of the container orchestration platform market, despite DevOps ...
1 year ago Venturebeat.com
CVE-2023-26031 - Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to ...
55 years ago Tenable.com
CVE-2024-29018 - Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP ...
11 months ago
Vulnerability Recap 10/01/24: NVIDIA, Ivanti, Kia - “The vulnerability stems from inadequate validation of network data, allowing attackers to get the vulnerable system to install a malicious printer driver, and then send a print job to that driver triggering execution of the malicious code,” said ...
4 months ago Esecurityplanet.com
Guarding Kubernetes From the Threat Landscape - DZone - If compromised, attackers can exploit these broad permissions to manipulate deployments, introduce malicious code, gain unauthorized access to critical systems, steal sensitive data, or create backdoors for ongoing access. Part of the security ...
4 months ago Feeds.dzone.com
Cohesity partners with NVIDIA to harness the power of generative AI - Cohesity announced a collaboration with NVIDIA to help organizations safely unlock the power of generative AI and data using the recently announced NVIDIA NIM microservices and by integrating NVIDIA AI Enterprise into the Cohesity Gaia platform. ...
11 months ago Helpnetsecurity.com
Falcon Cloud Security Supports Google Cloud Run to Strengthen Serverless Application Security - We're thrilled to share that the CrowdStrike Falcon® sensor now fully supports Google Cloud Run, bringing advanced security capabilities to your serverless applications. While we announced this at Google Cloud Next in April 2024, this blog goes ...
7 months ago Crowdstrike.com
Palo Alto Networks Prevents Data Loss at Enterprise Scale with NVIDIA - With NVIDIA accelerated computing and AI software, cybersecurity leaders like Palo Alto Networks can safeguard vast amounts of sensitive information with unprecedented speed and accuracy, ushering in a new era of AI-driven data protection. The ...
4 months ago Paloaltonetworks.com
CISA Updates Toolkit with Nine New Resources to Promote Public Safety Communications and Cyber Resiliency - The Cybersecurity and Infrastructure Security Agency collaborates with public safety, national security, and emergency preparedness communities to enhance seamless and secure communications to keep America safe, secure, and resilient. Any ...
9 months ago Cisa.gov
A Look at Container Security Through the Lens of DevOps - According to Forrester, 71% of DevOps teams leverage containers and microservices to deliver applications. These facts warrant a closer look at container security, with a focus on how DevOps can provide a robust framework for the entire software ...
7 months ago Tripwire.com
Nvidia To Build Network Of AI Chip Plants In Japan - Nvidia chief Jensen Huang says company to work with local companies to build network of AI chip plants in Japan. Nvidia is to collaborate with local companies to build a network of semiconductor manufacturing facilities in Japan to meet demand for ...
1 year ago Silicon.co.uk
What Is Patch Management? - Containers are created using a container image, and a container image is created using a Dockerfile/Containerfile that includes instructions for building an image. Considering the patch management and vulnerability management for containers, let's ...
1 year ago Feeds.dzone.com
CVE-2024-0136 - NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and write access to host devices. This vulnerability is present only when the NVIDIA Container ...
1 month ago Tenable.com
Multiple NVIDIA CUDA Toolkit Vulnerabilities Let Attackers Trigger DoS - Attackers could crash analysis tools or leak memory contents by distributing weaponized cubin files – a critical risk for AI development teams sharing pre-trained models. These vulnerabilities, spanning the cuobjdump and nvdisasm utilities, expose ...
1 day ago Cybersecuritynews.com
CVE-2024-0137 - NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the host’s network namespace. This vulnerability is present only when the NVIDIA Container ...
1 month ago Tenable.com
NVIDIA Container Toolkit Vulnerability Let Attackers Execute Code - Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Researchers from Wiz Research noted that CVE-2025-23359 bypasses an earlier vulnerability, CVE-2024-0132, which was patched in ...
1 week ago Cybersecuritynews.com
CVE-2021-20188 - A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, ...
4 years ago
CVE-2024-3056 - A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least one other container, can create a large number of IPC resources in /dev/shm. The malicious ...
4 months ago

Cyber Trends (last 7 days)


Trending Cyber News (last 7 days)