SUSE-SU-2025:4187-1: critical: Security update for nvidia-container-toolkit
SLE-SECURITY-UPDATES
null at suse.de
Mon Nov 24 12:34:08 UTC 2025
# Security update for nvidia-container-toolkit
Announcement ID: SUSE-SU-2025:4187-1
Release Date: 2025-11-24T07:59:26Z
Rating: critical
References:
* bsc#1231032
* bsc#1231033
* bsc#1232855
* bsc#1236496
* bsc#1236497
* bsc#1236498
* bsc#1237085
* bsc#1246614
* bsc#1246860
Cross-References:
* CVE-2024-0132
* CVE-2024-0133
* CVE-2024-0134
* CVE-2024-0135
* CVE-2024-0136
* CVE-2024-0137
* CVE-2025-23266
* CVE-2025-23267
* CVE-2025-23359
CVSS scores:
* CVE-2024-0132 ( SUSE ): 8.9
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
* CVE-2024-0132 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2024-0132 ( NVD ): 9.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
* CVE-2024-0132 ( NVD ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2024-0133 ( SUSE ): 2.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
* CVE-2024-0133 ( SUSE ): 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
* CVE-2024-0133 ( NVD ): 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
* CVE-2024-0133 ( NVD ): 3.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N
* CVE-2024-0134 ( SUSE ): 1.8
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
* CVE-2024-0134 ( SUSE ): 3.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
* CVE-2024-0134 ( NVD ): 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
* CVE-2024-0134 ( NVD ): 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
* CVE-2024-0135 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
* CVE-2024-0135 ( SUSE ): 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
* CVE-2024-0135 ( NVD ): 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
* CVE-2024-0135 ( NVD ): 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
* CVE-2024-0136 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
* CVE-2024-0136 ( SUSE ): 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
* CVE-2024-0136 ( NVD ): 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
* CVE-2024-0136 ( NVD ): 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
* CVE-2024-0137 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
* CVE-2024-0137 ( SUSE ): 5.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
* CVE-2024-0137 ( NVD ): 5.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
* CVE-2024-0137 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
* CVE-2025-23266 ( SUSE ): 9.4
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
* CVE-2025-23266 ( SUSE ): 9.0 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2025-23266 ( NVD ): 9.0 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2025-23267 ( SUSE ): 8.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H
* CVE-2025-23267 ( SUSE ): 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
* CVE-2025-23267 ( NVD ): 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
* CVE-2025-23359 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2025-23359 ( NVD ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2025-23359 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* Containers Module 15-SP6
* Containers Module 15-SP7
* openSUSE Leap 15.6
* SUSE Enterprise Storage 7.1
* SUSE Linux Enterprise High Performance Computing 15 SP3
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP3
* SUSE Linux Enterprise Server 15 SP3 LTSS
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP4 LTSS
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP5 LTSS
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP3
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
An update that solves nine vulnerabilities can now be installed.
## Description:
This update for nvidia-container-toolkit fixes the following issues:
* Update to version 1.18.0:
* This is a major release and includes the following high-level changes:
* The default mode of the NVIDIA Container Runtime has been updated to make use of a just-in-time-generated CDI specification instead of defaulting to the legacy mode.
* Added a systemd unit to generate CDI specifications for available devices automatically. This allows native CDI support in container engines such as Docker and Podman to be used without additional steps.
* Security issues fixed:
* CVE-2024-0133: Fixed data tampering in host file system via specially
crafted container image (bsc#1231032)
* CVE-2024-0132: Fixed time-of-check time-of-use (TOCTOU) race condition in
default configuration via specifically crafted container image (bsc#1231033)
* CVE-2024-0134: Fixed specially-crafted container image can lead to the
creation of unauthorized files on the host (bsc#1232855)
* CVE-2024-0135: Fixed Improper Isolation or Compartmentalization in NVIDIA
Container Toolkit (bsc#1236496)
* CVE-2024-0136: Fixed Improper Isolation or Compartmentalization in NVIDIA
Container Toolkit (bsc#1236497)
* CVE-2024-0137: Fixed Improper Isolation or Compartmentalization in NVIDIA
Container Toolkit (bsc#1236498)
* CVE-2025-23359: Fixed TOCTOU Vulnerability in NVIDIA Container Toolkit
(bsc#1237085)
* CVE-2025-23267: Fixed link following can lead to container escape
(bsc#1246614)
* CVE-2025-23266: Fixed hook initialization might lead to escalation of
privileges (bsc#1246860)
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-4187=1
* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-4187=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP3
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2025-4187=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2025-4187=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2025-4187=1
* SUSE Enterprise Storage 7.1
zypper in -t patch SUSE-Storage-7.1-2025-4187=1
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2025-4187=1
* Containers Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Containers-15-SP6-2025-4187=1
* Containers Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Containers-15-SP7-2025-4187=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2025-4187=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-4187=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-4187=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-4187=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-4187=1
* SUSE Linux Enterprise Server 15 SP3 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2025-4187=1
## Package List:
* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
* SUSE Enterprise Storage 7.1 (aarch64 x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
* Containers Module 15-SP6 (aarch64 ppc64le x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
* Containers Module 15-SP7 (aarch64 ppc64le x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64
x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64
x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64
x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64
x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64
x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
* SUSE Linux Enterprise Server 15 SP3 LTSS (aarch64 ppc64le x86_64)
* nvidia-container-toolkit-1.18.0-150200.5.17.1
## References:
* https://www.suse.com/security/cve/CVE-2024-0132.html
* https://www.suse.com/security/cve/CVE-2024-0133.html
* https://www.suse.com/security/cve/CVE-2024-0134.html
* https://www.suse.com/security/cve/CVE-2024-0135.html
* https://www.suse.com/security/cve/CVE-2024-0136.html
* https://www.suse.com/security/cve/CVE-2024-0137.html
* https://www.suse.com/security/cve/CVE-2025-23266.html
* https://www.suse.com/security/cve/CVE-2025-23267.html
* https://www.suse.com/security/cve/CVE-2025-23359.html
* https://bugzilla.suse.com/show_bug.cgi?id=1231032
* https://bugzilla.suse.com/show_bug.cgi?id=1231033
* https://bugzilla.suse.com/show_bug.cgi?id=1232855
* https://bugzilla.suse.com/show_bug.cgi?id=1236496
* https://bugzilla.suse.com/show_bug.cgi?id=1236497
* https://bugzilla.suse.com/show_bug.cgi?id=1236498
* https://bugzilla.suse.com/show_bug.cgi?id=1237085
* https://bugzilla.suse.com/show_bug.cgi?id=1246614
* https://bugzilla.suse.com/show_bug.cgi?id=1246860
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20251124/2f8bea1e/attachment.htm>
More information about the sle-security-updates
mailing list