SB2025012963 - Fedora 40 update for golang-github-nvidia-container-toolkit
Published: January 29, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) UNIX symbolic link following (CVE-ID: CVE-2024-0134)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to a symlink following issue. A remote user can use a specially crafted container image to create unauthorized files on the host, leading to data tampering.
2) Improper isolation or compartmentalization (CVE-ID: CVE-2024-0135)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to improper isolation or compartmentalization. A remote administrator can use a specially crafted container image and execute arbitrary code on the target system.
3) Improper isolation or compartmentalization (CVE-ID: CVE-2024-0136)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to improper isolation or compartmentalization. A remote administrator can use a specially crafted container image and execute arbitrary code on the target system.
4) Improper isolation or compartmentalization (CVE-ID: CVE-2024-0137)
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to improper isolation or compartmentalization, which leads to security restrictions bypass and privilege escalation.
Remediation
Install update from vendor's website.