CVE-2024-0110

What it actually does

Out-of-bounds write in cuobjdump when parsing a malformed ELF file, enabling arbitrary code execution or denial of service.

Why it matters to the business

Attackers could execute code on developer or compute systems handling CUDA files or cause service disruptions in GPU/AI workloads; low but stable exploit probability with remediation available in pterodactyl/wings 1.11.12 after 774 days of exposure.

How an attack unfolds

An attacker creates a specially crafted malformed ELF file and supplies it to the cuobjdump command; successful parsing triggers the out-of-bounds write that can be leveraged for code execution or crash.

How to fix it

Upgrade github.com/pterodactyl/wings to version 1.11.12 or later; apply any corresponding NVIDIA CUDA Toolkit patches that address the cuobjdump ELF handling issue.

How to confirm the fix worked

Confirm package versions match or exceed the fixed releases; test cuobjdump behavior against known-malformed ELF samples in a controlled environment to verify absence of the write flaw.

Typical attack path

1. Craft a malformed ELF file designed to trigger the parsing flaw
2. Invoke cuobjdump against the file via command line or automated tooling
3. Trigger the out-of-bounds write to achieve code execution or denial of service

How to detect it

Review process execution logs and crash reports for cuobjdump invocations involving unexpected or externally sourced ELF files; monitor for abnormal memory writes or segmentation faults during ELF parsing.

What your security team should do

• Immediately update pterodactyl/wings to 1.11.12 across all environments
• Inventory all systems using CUDA Toolkit and schedule patching
• Restrict untrusted ELF file processing with cuobjdump until updates are applied