CVE-2024-0123
Nvidia Cuda Toolkit ≤ 12.6.2
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-0123 is a low-severity Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) vulnerability in Nvidia Cuda Toolkit. Its CVSS base score is 3.3 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-15924
Vulnerability Data
NVIDIA CUDA toolkit for Windows and Linux contains a vulnerability in the nvdisasm command line tool where an attacker may cause an improper validation in input issue by tricking the user into running nvdisasm on a malicious ELF file. A…
more
successful exploit of this vulnerability may lead to denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V2.1.1V2.2.1V2.2.2V5.3.3
Mitigating Controls (NIST 800-53 r5) AI
Requires explicit validation of supplied indices/offsets/positions before they are used to access buffers or other indexable resources.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability identification processes can discover missing index validation via scanning or reviews.
Patching and replacement can remediate instances of the weakness after discovery.
Secure SDLC practices directly require input validation, preventing this class of flaw at development time.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates secure SDLC practices including secure coding guidelines, security requirements, checkpoints, testing (scans/penetration), and developer training that reach index/offset validation defects, but leaves a bounded remainder (e.g. incomplete enforcement across all languages, outsourced code without full assurance, or post-release changes)
A.8.26 explicitly lists resilience against SQL injections plus input validation/integrity checks (items d, j) as application security requirements to identify/address via risk assessment; this reaches a minority slice of index/offset validation defects but leaves most instances (non-web, non-SQL, incomplete enforcement, second-order) unaddressed by the requirements-setting process itself.
A.8.27 mandates security engineering principles including data validation/sanitization, distrust-external-input, security-by-design reviews against attack patterns, and hardening; this reaches a minority slice of CWE-1285 (index/offset validation in new designs) but leaves most instances (existing code, incomplete application of principles, or post-design defects) exploitable.
Secure coding standards directly require validation of indices, positions, and offsets before use.
Security testing can detect missing or incorrect index validation during development and acceptance.