CVE-2021-1056

CVE-2021-1056 CVE-2021-1056 是我向 NVIDIA PSIRT 提交的一个漏洞。个人认为，在多租户 HPC 集群（尤其是云机器学习平台）中，它可能导致较高的安全风险。 本仓库简单地演示了该漏洞在由 nvidia-container-runtime 创建的 GPU 容器中的表现。 工作原理 通过创建特定的字符设备文件，GPU 容器（由 nvidia-container-runtime 创建的容器）中的攻击者能够访问宿主机上所有的 GPU 设备。 该漏洞同样适用于在 Kubernetes 集群上由 k8s-device-plugin 创建的 GPU Pod。 前提条...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: syft, opentelemetry-collector-contrib-fips, gosu, cluster-autoscaler-fips, buildah, grafana-alloy, podman, cadvisor-fips, grype, kubernetes-fips, neuvector, opentelemetry-collector-contrib, cluster-autoscaler, kubernetes, runc, k8s-device-plugin, neuvector-fips, k3s,...

GO-2026-5761 vulnerabilities

Vulnerabilities for packages: buildah, nvidia-container-toolkit, node-feature-discovery, podman, k8s-device-plugin, cadvisor, sriov-network-device-plugin...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: buildah, docker, podman, grype, ctop, opentelemetry-collector-contrib, syft, runc, neuvector-scanner, grafana-alloy, k3s, k8s-device-plugin, cadvisor, kubernetes...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, nodetaint, local-static-provisioner, kubeflow-pipelines, argocd-image-updater, spark-operator, kubernetes-dns-node-cache, k8s-device-plugin, ip-masq-agent, aws-efs-csi-driver, cri-tools...

GO-2026-4440 vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, wuzz, runc, k3s, aws-load-balancer-controller, k8s-device-plugin, gitness...

GO-2024-3286 vulnerabilities

Vulnerabilities for packages: nodetaint, local-static-provisioner, kubeflow-pipelines, argocd-image-updater, kubernetes-dns-node-cache, k8s-device-plugin, ip-masq-agent, aws-efs-csi-driver...

GO-2026-4441 vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, wuzz, runc, k3s, aws-load-balancer-controller, k8s-device-plugin, gitness...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, istio, dask-gateway, karpenter, redka, cloud-provider-aws, external-dns, prometheus-operator, runc, telegraf, kaf, kube-fluentd-operator, cert-manager, kubernetes-dashboard, zot, gitlab-pages, flux, falco-no-driver, go, kubescape,...

GHSA-XJVP-4FHW-GC47 vulnerabilities

Vulnerabilities for packages: nvidia-container-toolkit-fips, node-feature-discovery, prometheus-podman-exporter-fips, nvidia-container-toolkit, buildah, gpu-operator, podman, sriov-network-device-plugin, cadvisor-fips, sriov-network-device-plugin-fips, node-feature-discovery-fips, rancher,...

GHSA-XJVP-4FHW-GC47 vulnerabilities

Vulnerabilities for packages: buildah, nvidia-container-toolkit, node-feature-discovery, podman, k8s-device-plugin, cadvisor, sriov-network-device-plugin...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, istio, dask-gateway, karpenter, redka, cloud-provider-aws, external-dns, prometheus-operator, runc, telegraf, kaf, kube-fluentd-operator, cert-manager, kubernetes-dashboard, zot, gitlab-pages, flux, falco-no-driver, go, kubescape,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: nri-discovery-kubernetes, yace, vendir, chisel, osv-scanner, aws-s3-controller, scorecard, flux-source-controller, ytt, aws-flb-firehose, crossplane-provider-sql, vertical-pod-autoscaler, cluster-api-ipam-provider-in-cluster, gitlab-kas, lazygit, aws-flb-cloudwatch,...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: nri-discovery-kubernetes, yace, thanos, vendir, osv-scanner, flux-kustomize-controller, scorecard, flux-source-controller, ytt, aws-flb-firehose, crossplane-provider-sql, vertical-pod-autoscaler, gops, aws-flb-cloudwatch, nri-f5, slsa-verifier, glow, ip-masq-agent,...

CVE-2024-45336 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib-fips, buildkitd-fips, gcp-compute-persistent-disk-csi-driver, docker-credential-gcr, opentofu-fips, grafana, vertical-pod-autoscaler, kube-state-metrics, aws-ebs-csi-driver, aws-efs-csi-driver-fips, fluent-bit-plugin-loki, flannel,...