NVIDIA CUDA Toolkit Vulnerability: Denial of Service Risk in cuobjdump and nvdisasm
Summary
DEBIAN-CVE-2024-0072: NVIDIA CUDA toolkit for all platforms contains a vulnerability in cuobjdump and nvdisasm where an attacker may cause a crash by tricking a user into reading a malformed ELF file. Affects nvidia-cuda-toolkit versions < 12.4.1-1. Fixed in 12.4.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NVIDIA CUDA Toolkit is a comprehensive suite of tools and libraries designed for developers to build and optimize applications that leverage the power of NVIDIA GPUs. It includes a range of components such as compilers, libraries, and debugging tools. This toolkit is widely used in high-performance computing, machine learning, and graphics rendering. However, it has been identified that certain components of the toolkit, specifically cuobjdump and nvdisasm, are susceptible to a vulnerability that could lead to a denial of service.
Vulnerability Detail
The vulnerability in the NVIDIA CUDA Toolkit arises from the handling of malformed ELF files by the cuobjdump and nvdisasm tools. An attacker can exploit this vulnerability by tricking a user into processing a specially crafted ELF file, which may cause the application to crash. This could result in a partial denial of service, affecting the availability of the toolkit's functionalities. The vulnerability is classified under CVE-2024-0072 and affects versions prior to 12.4.1-1.
How To Fix
Minimum fixed version
12.4.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nvidia-cuda-toolkitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid processing untrusted ELF files with cuobjdump and nvdisasm until the toolkit is updated to the patched version. Additionally, implementing strict file validation before processing can help mitigate the risk of exploitation.
Conclusion
The NVIDIA CUDA Toolkit has a critical vulnerability (CVE-2024-0072) that can lead to denial of service through the exploitation of malformed ELF files. Users are strongly encouraged to update to the latest patched version to mitigate this risk. For those unable to update immediately, it is advisable to avoid processing untrusted files and to implement workarounds to minimize exposure.
See every vulnerability recorded for nvidia-cuda-toolkit →
FAQ
CVE-2024-0072 is the identifier for a vulnerability in the NVIDIA CUDA Toolkit that allows an attacker to cause a denial of service by exploiting malformed ELF files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary symptom of this vulnerability is an unexpected crash of the cuobjdump or nvdisasm tools when processing a malformed ELF file.
While the vulnerability primarily leads to a denial of service, it does not directly cause data loss. However, it may disrupt ongoing processes that rely on the toolkit.
If an immediate update is not possible, refrain from processing untrusted ELF files and consider implementing additional file validation measures.
References
Related vulnerabilities
Recent vulnerabilities recorded for nvidia-cuda-toolkit.
