CVE-2024-0109

What it actually does

A malformed ELF file passed to cuobjdump triggers an out-of-bounds read in unprivileged process memory, resulting in a crash and limited denial of service.

Why it matters to the business

Limited denial of service can disrupt development and build workflows that rely on the affected tool; the issue affects 1,248 downstream dependents across the ecosystem, increasing the scope of potential operational interruptions.

How an attack unfolds

An attacker supplies a specially crafted malformed ELF file to the cuobjdump command, which processes the file and performs an out-of-bounds read leading to a crash.

How to fix it

Upgrade affected installations of NVIDIA CUDA Toolkit to a version that resolves the cuobjdump vulnerability; apply the listed fixed versions for any downstream packages such as tomcat-embed-core 9.0.81, jetty http2 9.4.53, golang.org/x/net 0.17.0, grpc 1.56.3/1.57.1/1.58.3, swift-nio-http2 1.28.0, and Tomcat Coyote 10.1.14 or 11.0.0-M12.

How to confirm the fix worked

Verify the installed CUDA Toolkit version and confirm cuobjdump no longer crashes on the previously malformed test ELF; scan dependency manifests for the listed packages and confirm they meet the fixed version numbers.

Typical attack path

1. Obtain or craft a malformed ELF binary
2. Invoke cuobjdump with the malformed file as input
3. Trigger the out-of-bounds read resulting in process crash

How to detect it

Review process execution logs and command-line history for invocations of cuobjdump with suspicious or non-standard ELF files; look for sudden crashes or segmentation faults in unprivileged processes handling ELF inputs.

What your security team should do

• Prioritize patching NVIDIA CUDA Toolkit and the 1,248 downstream dependents within normal change windows
• Add malformed ELF file handling tests to CI pipelines that invoke cuobjdump
• Monitor for any increase in EPSS or new exploit maturity signals