Security Vulnerability: GNU C Library (glibc) 2.13 <= 2.40 - Local Arbitrary Code Execution Vulnerability - 2.41
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.6k
- Forks
- 2.4k
- Avg merge
- 53m
- Merged PRs (30d)
- 1
Description
Hi,
We have found below vulnerabilities on nvcr.io/nvidia/cuda:12.9.1-base-ubi9. We request you to remediate in the upcoming version. PFA
glibc@glibc@2.34-168.el9_6.19 - should be greater than 2.40
Technical Impact:
Spoofing a [user identity|external node|other (please define)]
Tampering with [patient data (PHI) | configuration data | binary | process | other (please define)]
Repudiation [a user's activity | other (please define)]
Disclosure of [patient data (PHI) | user data | user credentials | intellectual property | other (please define)]
Denial of service
Elevation of privilege
Thanks and Regards,
Anjani
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the attached cuda-12-9-1.json and the referenced nvcr.io/nvidia/cuda:12.9.1-base-ubi9 image, then verify whether cuda-samples owns the affected glibc package or image build. Done means the relevant upcoming image no longer reports the stated glibc vulnerability, with the ownership and verification path documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, docker
- Domain
- devops, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100