NVIDIA

A critical flaw, CVE-2024-0132, in NVIDIA’s Container Toolkit has remained exploitable due to an incomplete patch, leaving AI infrastructure and sensitive data at risk. This vulnerability, coupled with a newly found Docker DoS flaw on Linux, endangers systems by potentially letting attackers steal AI models, disrupt operations, or execute DoS attacks. The initial patch provided by NVIDIA was later found to be inadequate for versions 1.17.3 and below, and conditionally for 1.17.4, making them susceptible to breaches and command execution with root privileges. The Docker issue can result in CPU usage spikes and SSH access loss, disrupting services and rendering systems unresponsive. The exposure primarily affects organizations using these tools for AI or cloud workloads, including industries like healthcare, finance, and autonomous systems.

Source: https://cybersecuritynews.com/nvidias-incomplete-patch-for-critical-flaw-lets-attackers-steal-ai-model-data/

"id": "nvi108041225",
"linkid": "nvidia",
"type": "Vulnerability",
"date": "4/2025",
"severity": "100",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"