Faulty Nvidia Bug Patch Puts AI Containers at Risk

Users of software developed by AI powerhouse Nvidia for running containerized software on its GPU chips could still be vulnerable to hacks even if they applied a September 2024 patch, warns cybersecurity firm Trend Micro.

See Also: Fortinet Expands FortiAI Across Security Fabric Platform

Researchers said that a recently patched vulnerability in Nvidia Container Toolkit didn’t completely fix the flaw, tracked as CVE-2024-0132.

The vulnerability is linked to how the nvidia-container-cli component manages device file mounts inside containers. The update corrected one exploitation path but did not prevent similar attacks through alternate methods, researchers said.

Exploitation of the vulnerability could lead to “unauthorized access to sensitive host data, theft of proprietary AI models or intellectual property, severe operational disruptions, and prolonged downtime due to resource exhaustion or system inaccessibility,” wrote the report’s author Abdelrahman Esmail.

The core issue lies in symbolic link handling. When the toolkit mounts host-side GPU resources into containers, it performs insufficient validation of file paths, allowing attackers to potentially trick the system into interacting with unintended host files. Trend Micro demonstrated that by modifying how container configurations define device file access, it is possible to exploit the flaw using symlinks. This behavior persists even with the January patch applied, leaving systems that rely on GPU-enabled containers vulnerable to host resource exposure.

The toolkit is widely used in machine learning and AI environments, particularly in setups where containerized applications require GPU acceleration. Because these workloads often operate in shared infrastructure, improper isolation may allow attackers to interfere with or gain access to co-located systems or data.

Trend Micro said that exploitation requires access to a running container. The attack uses user-controllable paths and symlinks to trigger unexpected interactions between the container and host system.

While the original patch addressed a specific symlink traversal issue, it did not cover the broader category of potential mount manipulations. The researchers did not publish a full proof-of-concept code but provided technical details showing how the attack can still work in practice.

Trend Micro said it disclosed its findings to Nvidia and published its analysis to raise awareness of the continued risk. There was no public indication that Nvidia had issued a revised patch or advisory addressing the residual vulnerability at the time of this article’s publication.

Trend Micro said that this vulnerability demonstrates how incomplete fixes can lead to continued exposure, advising that mitigations should address the design-level issues that allow unsafe mounts or symlink traversals, rather than only closing off known attack vectors.

The research also focuses on the challenges in securing container runtimes that depend on external hardware access, particularly in systems optimized for performance, such as AI model training or inferencing.

The severity of the vulnerability should prompt organizations to take immediate action to patch their systems and better manage software risk, said Thomas Richards, infrastructure security practice director at application security solution provider Black Duck. “Given how Nvidia has become the de facto standard for AI processing, this potentially affects every organization involved in the AI space,” he told Information Security Media Group.

No active exploitation has been reported yet, but the ease of reproducing the flaw in test environments may increase the risk of abuse in real-world deployments.