Cyber Resilience

CVE-2024-0132

Race Condition in Nvidia Container Toolkit ≤ 1.16.2

Race Condition
Published
26 September 2024
Modified
02 October 2024
Patch / advisory
View advisory
CVSS Score v3.1 9.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.37 98th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2024-0132 is a critical-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Linux Linux Kernel. Its CVSS base score is 9.0 (Critical).

Operationally, ranked in the top 2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is…

more

used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CWE(s)
CWE-367

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1611 Escape to Host Privilege Escalationconfidence: HIGH
TOCTOU race in NVIDIA Container Toolkit allows crafted container image to escape to host filesystem, directly enabling container escape.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Successful container escape via the TOCTOU flaw grants elevated privileges on the host.
attack.mitre.org →
T1203 Exploitation for Client Execution Executionconfidence: MEDIUM
Exploitation of the container runtime flaw can result in arbitrary code execution on the host.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-0133Same product: Linux Linux Kernel
CVE-2025-23359Same product: Linux Linux Kernel
CVE-2024-0134Same product: Linux Linux Kernel
CVE-2025-38217Same product: Linux Linux Kernel
CVE-2026-53250Same product: Linux Linux Kernel
CVE-2026-31678Same product: Linux Linux Kernel
CVE-2023-52478Same product: Linux Linux Kernel
CVE-2025-22060Same product: Linux Linux Kernel
CVE-2025-21746Same product: Linux Linux Kernel
CVE-2025-21958Same product: Linux Linux Kernel

Affected Assets

nvidia
nvidia container toolkit
≤ 1.16.2
nvidia
nvidia gpu operator
≤ 24.6.2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V15.4.2
  • V17.2.6

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-8 Time Stamps
addresses: CWE-367

Timestamps meeting UTC or offset standards help identify TOCTOU issues through precise chronological reconstruction of check/use operations.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.17 Clock synchronization none match
none

Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.

References