Security Bulletin: NVIDIA CUDA Toolkit - August 2024

2024-08-2900:00:00

nvidia.custhelp.com

nvidia

cuda toolkit

security update

vulnerability

fixes

affected versions

windows

linux

risk assessment

software update

command cuobjdump

elf file

cve ids

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

5.8

Confidence

High

EPSS

0.001

Percentile

22.4%

JSON

NVIDIA has released a software update for NVIDIA® CUDA® Toolkit. To protect your system, download and install this software update from the CUDA Toolkit Downloads page.

Go to NVIDIA Product Security.

Details

This section provides a summary of potential vulnerabilities that this security update addresses and their impact. Descriptions use CWE™, and base scores and vectors use CVSS v3.1 standards.

CVE ID	Description	Vector	Base Score	Severity	CWE	Impacts
CVE-2024-0110	NVIDIA CUDA Toolkit contains a vulnerability in command `cuobjdump` where a user may cause an out-of-bound write by passing in a malformed ELF file. A successful exploit of this vulnerability may lead to code execution or denial of service.	AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N	4.4	Medium	CWE‑787	Code execution, denial of service
CVE-2024-0111	NVIDIA CUDA Toolkit contains a vulnerability in command ‘cuobjdump’ where a user may cause a crash or produce incorrect output by passing a malformed ELF file. A successful exploit of this vulnerability may lead to a limited denial of service or data tampering.	AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L	4.4	Medium	CWE‑1284	Denial of service, data tampering
CVE-2024-0109	NVIDIA CUDA Toolkit contains a vulnerability in command `cuobjdump` where a user may cause a crash by passing in a malformed ELF file. A successful exploit of this vulnerability may cause an out of bounds read in the unprivileged process memory which could lead to a limited denial of service.	AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L	3.3	Low	CWE‑125	Denial of service

The NVIDIA risk assessment is based on an average of risk across a diverse set of installed systems and may not represent the true risk to your local installation. NVIDIA recommends evaluating the risk to your specific configuration.