Denial of Service Vulnerability in NVIDIA CUDA Toolkit: cuobjdump and nvdisasm
Summary
DEBIAN-CVE-2024-0076: NVIDIA CUDA toolkit for all platforms contains a vulnerability in cuobjdump and nvdisasm where an attacker may cause a crash by tricking a user into reading a malformed ELF file. Affects nvidia-cuda-toolkit versions < 12.4.1-1. Fixed in 12.4.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NVIDIA CUDA Toolkit is a comprehensive development environment for building GPU-accelerated applications. It includes libraries, debugging, and optimization tools, and supports various programming languages. This toolkit is widely used in high-performance computing, machine learning, and data science. However, it has been found to contain a vulnerability that can be exploited through malformed ELF files, potentially leading to application crashes.
Vulnerability Detail
NVIDIA CUDA Toolkit has a vulnerability in its cuobjdump and nvdisasm components. An attacker can exploit this vulnerability by tricking a user into processing a malformed ELF file, which may result in a crash of the application. This could lead to a partial denial of service, affecting the availability of the application. The vulnerability is present in versions prior to 12.4.1-1 and can be exploited without requiring advanced technical skills.
How To Fix
Minimum fixed version
12.4.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nvidia-cuda-toolkitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid opening untrusted ELF files to mitigate the risk of exploitation until the toolkit is updated.
Conclusion
The NVIDIA CUDA Toolkit has a critical vulnerability that can lead to a denial of service through the exploitation of malformed ELF files. Users are strongly advised to update to the latest version to protect their applications from potential crashes.
See every vulnerability recorded for nvidia-cuda-toolkit →
FAQ
The NVIDIA CUDA Toolkit is a software development kit that allows developers to create applications that leverage the power of NVIDIA GPUs.
The vulnerability allows an attacker to crash the application by tricking a user into reading a malformed ELF file, leading to a denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid processing untrusted ELF files to reduce the risk of exploitation.
Detailed information about this vulnerability can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-0076.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for nvidia-cuda-toolkit.
