CVE-2024-0123: 
CUDA Toolkit vulnerability analysis and mitigation

CVE-2024-0123 is a vulnerability discovered in the NVIDIA CUDA toolkit affecting Windows and Linux systems. The vulnerability exists in the nvdisasm command line tool and was disclosed on October 2, 2024. The issue affects all versions of NVIDIA CUDA Toolkit up to and including version 12.6U1 (NVIDIA Security).

The vulnerability involves an improper validation of input in the nvdisasm command line tool. It has been assigned a CVSS v3.1 base score of 3.3 (Low severity) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. The vulnerability is classified under CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input) (Red Hat CVE, NVIDIA Security).

If successfully exploited, this vulnerability can lead to a denial of service condition when a user is tricked into running nvdisasm on a malicious ELF file. The impact is limited to availability, with no direct effects on confidentiality or integrity of the system (NVIDIA Security).

NVIDIA has released CUDA Toolkit version 12.6U2 to address this vulnerability. Users are recommended to upgrade to this latest version. The fix is available for both Windows and Linux platforms (NVIDIA Security).

The vulnerability was responsibly disclosed by nEINEI from Tencent-zhuquelab, demonstrating ongoing security research collaboration between security researchers and NVIDIA (NVIDIA Security).