Skip to content
brandefense.io
Request A Demo
WatchlistCritical

CVE-2024-0132Nvidia Container Toolkit Vulnerability

NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability

Published Sep 27, 2024 · Updated Sep 10, 2026 · Also known as GHSA-mjjw-553x-87pq, GO-2024-3239, SUSE-SU-2024:3950-1, TR-24-1554

Key Facts

Patch immediately
  • CVE-2024-0132 is a critical-severity vulnerability (CVSS 9.3 v4) affecting Nvidia Container Toolkit, Nvidia Gpu Operator, nvidia-gpu-operator-validator-24.3 (chainguard) and 7 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
  • EPSS estimates a 41% probability of exploitation in the next 30 days.
  • Fixed versions are available, including github.com/NVIDIA/nvidia-container-toolkit 1.16.2, govulncheck-vulndb 0.0.20241104T154416-1.1, govulncheck-vulndb 0.0.20241104T154416-150000.1.12.1.
  • Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Scores

CVSS v4

9.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS (30-day exploit likelihood)

41%

Higher than 98.6% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

46/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

1

Proof-of-concept links

In-the-wild evidence

0

Reports of active use

Advisories And Exploit References

Description

NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Affected Products

79 affected entries in total
ProductAffected versionsFixed in
Nvidia Container ToolkitNvidiaSee advisory1.16.2
Nvidia Gpu OperatorNvidiaSee advisory24.6.2
nvidia-gpu-operator-validator-24.3chainguardSee advisory24.3.0-r4
github.com/NVIDIA/nvidia-container-toolkitgo>= All versions up to and including v1.16.11.16.2
govulncheck-vulndbsuseSee advisory0.0.20241104T154416-150000.1.12.1
5 more affected products in the full CVE brief

Patched Releases

github.com/NVIDIA/nvidia-container-toolkit

1.16.2

govulncheck-vulndb

0.0.20241104T154416-1.1, 0.0.20241104T154416-150000.1.12.1, 0.0.20241104T154416-5.1

libnvidia-container-devel

1.18.0-150200.5.9.1

libnvidia-container-static

1.18.0-150200.5.9.1

libnvidia-container-tools

1.18.0-150200.5.9.1

libnvidia-container1

1.18.0-150200.5.9.1

Nvidia Container Toolkit

1.16.2, 1.16.2-1, 1.16.2-r0, 1.18.0-150200.5.17.1

Nvidia Gpu Operator

24.6.2

nvidia-gpu-operator-validator-24.3

24.3.0-r4

Timeline

  1. Publicly disclosed

    Sep 27, 2024

  2. Last updated

    Sep 10, 2026

Weakness Type

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2024-0132 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.

Request A Demo

Figures as of Oct 19, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.