CVE-2024-0132: NVIDIA Container Toolkit Privilege Escalation

CVE-2024-0132 Overview

NVIDIA Container Toolkit version 1.16.1 and earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration. A specifically crafted container image may exploit this race condition to gain unauthorized access to the host file system. This vulnerability does not impact use cases where Container Device Interface (CDI) is used.

Critical Impact

A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering on the host system.

Affected Products

• NVIDIA Container Toolkit (versions 1.16.1 and earlier)
• NVIDIA GPU Operator (affected versions)
• Linux Kernel (as underlying host platform)

Discovery Timeline

• 2024-09-26 - CVE-2024-0132 published to NVD
• 2024-10-02 - Last updated in NVD database

Technical Details for CVE-2024-0132

Vulnerability Analysis

This vulnerability is classified as CWE-367: Time-of-check Time-of-Use (TOCTOU) Race Condition. The flaw exists in the NVIDIA Container Toolkit's handling of container image resources when operating under default configuration.

The TOCTOU vulnerability occurs when the software performs a security check on a resource at one point in time (time-of-check), but uses that resource at a later point (time-of-use). During the window between check and use, an attacker can modify the resource to bypass security controls. In this case, the vulnerability allows a malicious container image to manipulate file system access, potentially escaping container isolation and gaining access to the host file system.

The network attack vector with high complexity indicates that while the vulnerability can be triggered remotely through container deployment, successful exploitation requires precise timing and specific conditions to win the race condition.

Root Cause

The root cause lies in the TOCTOU race condition within the NVIDIA Container Toolkit's default configuration mode. When processing container images, the toolkit performs security validation checks on resources, but a timing gap exists between this validation and the actual resource utilization. An attacker can exploit this gap by crafting a malicious container image that modifies the checked resource during this window, causing the toolkit to process unauthorized content.

The vulnerability specifically affects the default configuration and does not impact deployments using the Container Device Interface (CDI), suggesting the race condition exists in the legacy device handling pathway.

Attack Vector

The attack requires an adversary to craft a specially designed container image that exploits the timing window in the NVIDIA Container Toolkit. The attack scenario involves:

1. Creating a malicious container image designed to trigger the race condition
2. Deploying the container on a system running NVIDIA Container Toolkit 1.16.1 or earlier with default configuration
3. Exploiting the TOCTOU gap to manipulate file system access during the check-use window
4. Gaining unauthorized access to the host file system once the race is won

The vulnerability allows potential container escape, enabling an attacker to break out of the container isolation boundary and interact with the host system. This could lead to reading sensitive host files, modifying host configurations, executing arbitrary code on the host, or disrupting host services.

Detection Methods for CVE-2024-0132

Indicators of Compromise

• Unusual file system access patterns from container processes attempting to access host paths outside normal container mounts
• Container images with abnormal layer structures or suspicious timing-sensitive operations
• Unexpected process behavior from containers using NVIDIA GPU resources with elevated host file system access
• Anomalous symlink or file creation activities during container initialization

Detection Strategies

• Monitor container runtime logs for suspicious file system access attempts or access denied errors followed by successful access to the same resource
• Implement runtime security monitoring to detect container escape attempts and unexpected host file system interactions
• Audit NVIDIA Container Toolkit configurations to identify systems running default (non-CDI) configurations that are vulnerable
• Deploy container image scanning solutions to identify potentially malicious images before deployment

Monitoring Recommendations

• Enable detailed logging for NVIDIA Container Toolkit operations and correlate with host file system audit logs
• Implement real-time alerting for container processes attempting to access sensitive host paths
• Monitor for containers running with NVIDIA GPU access that exhibit unusual file system traversal patterns
• Track container image provenance and implement allowlisting for trusted container registries

How to Mitigate CVE-2024-0132

Immediate Actions Required

• Upgrade NVIDIA Container Toolkit to a patched version as recommended by NVIDIA
• Consider migrating to Container Device Interface (CDI) mode which is not affected by this vulnerability
• Audit existing container deployments for potentially malicious images
• Implement network segmentation to limit container registry access to trusted sources only

Patch Information

NVIDIA has released a security update to address this vulnerability. Administrators should consult the NVIDIA Support Article for detailed patch information and upgrade instructions for the NVIDIA Container Toolkit. The patch addresses the TOCTOU race condition in the default configuration mode.

Workarounds

• Switch to Container Device Interface (CDI) mode instead of default configuration, as CDI is not impacted by this vulnerability
• Implement strict container image policies to only allow images from trusted, verified sources
• Apply additional runtime security controls using tools like seccomp profiles and AppArmor/SELinux policies to limit container file system access
• Consider running containers in more isolated environments using virtual machines or dedicated nodes for untrusted workloads

# Check current NVIDIA Container Toolkit version
nvidia-ctk --version

# Verify if CDI mode is available and consider enabling it
# Consult NVIDIA documentation for CDI migration steps
nvidia-ctk cdi list