CVE-2024-53878: 
CUDA Toolkit vulnerability analysis and mitigation

NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability (CVE-2024-53878) in the cuobjdump binary, discovered and reported by Kai Lu from Palo Alto Networks. The vulnerability was disclosed on February 18, 2025, affecting all versions up to CUDA Toolkit 12.8 (NVIDIA Bulletin).

The vulnerability exists in the cuobjdump binary where a user could cause a crash by passing a malformed ELF file to cuobjdump. The vulnerability has been assigned a CVSS v3.1 base score of 2.8 (Low) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L. It is classified under CWE-1284 (Improper Validation of Specified Quantity in Input) (NVIDIA Bulletin).

A successful exploit of this vulnerability might lead to a partial denial of service. The vulnerability has been assessed as having low severity due to its limited impact scope and the requirement for local access (NVIDIA Bulletin).

The vulnerability requires local access (AV:L), low attack complexity (AC:L), low privileges (PR:L), and user interaction (UI:R) to be exploited. The attack can only be executed from a local position with some privileges required (NVIDIA Bulletin).

NVIDIA has released CUDA Toolkit 12.8 as a security update to address this vulnerability. Users running affected versions (all versions up to CUDA Toolkit 12.8) are recommended to upgrade to the latest release version (NVIDIA Bulletin).