A critical vulnerability in NVIDIA’s Container Toolkit, CVE-2024-0132, remains exploitable due to an incomplete patch, endangering AI infrastructure and sensitive data.

Coupled with a newly discovered denial-of-service (DoS) flaw in Docker on Linux, these issues could allow attackers to breach systems, steal proprietary AI models, or disrupt operations. Organizations using these tools for AI or cloud workloads must act swiftly to mitigate the risks.

Flawed Fix Leaves Systems Exposed

In September 2024, NVIDIA issued a security update for CVE-2024-0132, a flaw in its Container Toolkit rated 9.0 on the CVSS v3.1 scale. The vulnerability could let attackers escape container isolation, accessing the host file system and sensitive data. Users were urged to apply the patch immediately.

However, Trend Research’s October 2024 analysis revealed the fix was incomplete. Versions 1.17.3 and earlier of the NVIDIA Container Toolkit remain vulnerable under default settings, while version 1.17.4 is exploitable if the allow-cuda-compat-libs-from-container feature is enabled.

Disclosed as ZDI-25-087, this time-of-check time-of-use (TOCTOU) flaw allows attackers to bypass container restrictions, potentially compromising entire systems.

“This incomplete patch is a significant concern,” said a Trend Research spokesperson. “Organizations assuming they’re protected may still be at risk.” The vulnerability threatens AI-driven industries, where stolen models or data could lead to substantial losses.

Docker DoS Flaw Adds to the Threat

While investigating CVE-2024-0132, researchers uncovered a performance issue in Docker on Linux that could enable DoS attacks. The flaw arises when containers use multiple mounts with bind-propagation=shared.

These mounts create parent/child paths in the Linux mount table, but the entries persist after containers terminate, causing uncontrolled growth.

This exhausts file descriptors, preventing Docker from creating new containers and spiking CPU usage. In severe cases, users lose access to the host via SSH, effectively locking them out.

A proof-of-concept showed systems becoming unresponsive, with no new containers launching and connectivity severed.

A proof of concept (PoC) showing the DoS issue

The Docker security team noted that the issue might stem from Docker’s runtime or the Linux kernel’s mount handling. “The Docker API grants root-level privileges to anyone with access,” they said, underscoring the risk. Moby and NVIDIA independently reported similar findings, urging immediate attention.

Exploitation Scenarios

The vulnerabilities create serious threats. For CVE-2024-0132, an attacker could:

Craft malicious container images linked via a volume symlink.
Deploy them on a target system, directly or via supply chain attacks.
Exploit a race condition to access the host file system.
Use Container Runtime Unix sockets to run arbitrary commands with root privileges, gaining full control.

The Docker DoS flaw could be exploited to overwhelm system resources, halting AI workloads or critical services. Both vulnerabilities could lead to data theft, operational downtime, or compromised infrastructure.

Organizations using NVIDIA Container Toolkit or Docker on Linux are at risk, especially those running AI workloads like machine learning for healthcare, finance, or autonomous systems.

Default configurations in Toolkit versions 1.17.3 and earlier are vulnerable, while 1.17.4 requires specific feature activation. Docker users face the DoS threat, impacting industries reliant on containerized applications, such as tech and logistics.

How to Mitigate

Trend Research recommends:

Limit Docker API Access: Restrict access to authorized users and avoid unnecessary root privileges.
Disable Toolkit Features: Turn off non-essential features in version 1.17.4 to reduce risks.
Scan Container Images: Block vulnerable images in CI/CD pipelines using strict admission controls.
Monitor Mount Tables: Check for abnormal growth signaling exploitation attempts.
Audit Interactions: Regularly review container-to-host bindings and enforce isolation.
Use Anomaly Detection: Deploy tools to spot unauthorized access or suspicious activity.
Verify Patches: Test updates to ensure vulnerabilities are fully resolved.

The incomplete fix for CVE-2024-0132 and the Docker DoS flaw highlight the challenges of securing AI and containerized systems.

NVIDIA and Docker are expected to release updates, but organizations must act now. By adopting best practices and using advanced security tools, they can protect sensitive data and ensure operational continuity.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!

The post NVIDIA’s Incomplete Patch for Critical Flaw Lets Attackers Steal AI Model Data appeared first on Cyber Security News.