Docs

Volcengine Kubernetes Engine

Security announcements

NVIDIA Container Toolkit security vulnerability announcement (CVE-2024-0132)

NVIDIA Container Toolkit is a container runtime toolkit for the automatic configuration of containers to use NVIDIA GPUs. NVIDIA Container Toolkit version 1.16.1 and earlier contain a TOCTOU (Time-of-check Time-of-use) vulnerability that is exploitable by default, which could result in code execution, denial of service, privilege escalation, and information leakage.

Vulnerability level

The CVE-2024-0132 vulnerability has been assessed as a high-risk vulnerability by Volcano Engine. The CVSS score is 9.0.

Scope of impact

Within Volcengine Kubernetes Engine clusters, NVIDIA GPU nodes running NVIDIA Container Toolkit version 1.16.1 or earlier are affected by this vulnerability. The following methods can be used to check the NVIDIA Container Toolkit version on a node:

Step 1: After logging in to the node, execute the following command to view the NVIDIA Container Toolkit version:

/usr/bin/nvidia-container-toolkit --version

Method 2: NVIDIA GPU nodes that already existed before VKE released the patch are affected by this vulnerability, while nodes added afterward are not affected.

Patch version release dates by region

Region	North China 2 (Beijing)	South China 1 (Guangzhou)	East China 2 (Shanghai)	Asia Pacific (Johor)
Release Date	2024-10-10 12:00	2024-10-10 21:00	2024-10-9 23:30	2024-10-9 21:00

Preventive measures

Upgrade NVIDIA Container Toolkit to version 1.16.2 or later. VKE has released a fixed version (as shown in the table above). After this, any node added to a VKE cluster will automatically install version 1.16.2 of the NVIDIA Container Toolkit. For existing nodes, you can reinstall version 1.16.2 by re-adding them to the cluster. For detailed instructions, refer to Add existing node. If you are unable to complete the upgrade, please submit a ticket to obtain technical support.