{"id":10477,"date":"2025-07-18T12:36:08","date_gmt":"2025-07-18T05:36:08","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=10477"},"modified":"2026-02-05T12:36:16","modified_gmt":"2026-02-05T05:36:16","slug":"nvidia-phat-hanh-ban-va-khan-cho-hai-lo-hong-nguy-hiem-tren-he-thong-gpu-container","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/2025\/07\/18\/nvidia-phat-hanh-ban-va-khan-cho-hai-lo-hong-nguy-hiem-tren-he-thong-gpu-container\/","title":{"rendered":"NVIDIA ph\u00e1t h\u00e0nh b\u1ea3n v\u00e1 kh\u1ea9n cho hai l\u1ed7 h\u1ed5ng nguy hi\u1ec3m tr\u00ean h\u1ec7 th\u1ed1ng GPU container"},"content":{"rendered":"

NVIDIA v\u1eeba ph\u00e1t \u0111i c\u1ea3nh b\u00e1o kh\u1ea9n c\u1ea5p li\u00ean quan \u0111\u1ebfn hai l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong b\u1ed9 c\u00f4ng c\u1ee5 Container Toolkit v\u00e0 ph\u1ea7n m\u1ec1m GPU Operator. Hai l\u1ed7 h\u1ed5ng \u0111\u01b0\u1ee3c g\u00e1n m\u00e3 l\u1ea7n l\u01b0\u1ee3t l\u00e0 CVE-2025-23266 v\u00e0 CVE-2025-23267, \u1ea3nh h\u01b0\u1edfng tr\u1ef1c ti\u1ebfp \u0111\u1ebfn m\u00f4i tr\u01b0\u1eddng container s\u1eed d\u1ee5ng GPU, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng leo thang \u0111\u1eb7c quy\u1ec1n ho\u1eb7c l\u00e0m gi\u00e1n \u0111o\u1ea1n d\u1ecbch v\u1ee5.<\/b><\/p>\n

\n
\"NVIDIA.png\"<\/div>\n<\/div>\n

L\u1ed7 h\u1ed5ng CVE-2025-23266 \u0111\u01b0\u1ee3c \u0111\u00e1nh gi\u00e1 c\u00f3 m\u1ee9c \u0111\u1ed9 nghi\u00eam tr\u1ecdng cao v\u1edbi \u0111i\u1ec3m CVSS v3.1 \u0111\u1ea1t 9,0. V\u1ea5n \u0111\u1ec1 n\u1eb1m trong c\u00e1c \u0111o\u1ea1n m\u00e3 hook kh\u1edfi t\u1ea1o c\u1ee7a Container Toolkit tr\u00ean t\u1ea5t c\u1ea3 c\u00e1c n\u1ec1n t\u1ea3ng, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng th\u1ef1c thi m\u00e3 t\u00f9y \u00fd v\u1edbi \u0111\u1eb7c quy\u1ec1n n\u00e2ng cao. L\u1ed7i n\u00e0y tu\u00e2n theo m\u00f4 h\u00ecnh CWE-426, khai th\u00e1c th\u00e0nh c\u00f4ng c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn chi\u1ebfm quy\u1ec1n h\u1ec7 th\u1ed1ng, r\u00f2 r\u1ec9 d\u1eef li\u1ec7u v\u00e0 l\u00e0m gi\u00e1n \u0111o\u1ea1n ho\u1ea1t \u0111\u1ed9ng.<\/p>\n

L\u1ed7 h\u1ed5ng th\u1ee9 hai, CVE-2025-23267, c\u00f3 \u0111i\u1ec3m CVSS 8,5, \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn hook update-ldcache. K\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 l\u1ee3i d\u1ee5ng h\u00e0nh vi theo li\u00ean k\u1ebft th\u00f4ng qua h\u00ecnh \u1ea3nh container \u0111\u01b0\u1ee3c t\u1ea1o \u0111\u1eb7c bi\u1ec7t. L\u1ed7i n\u00e0y thu\u1ed9c nh\u00f3m CWE-59, cho ph\u00e9p s\u1eeda \u0111\u1ed5i d\u1eef li\u1ec7u ho\u1eb7c g\u00e2y gi\u00e1n \u0111o\u1ea1n ho\u1ea1t \u0111\u1ed9ng c\u1ee7a h\u1ec7 th\u1ed1ng.<\/p>\n

C\u1ea3 hai l\u1ed7 h\u1ed5ng \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn NVIDIA Container Toolkit t\u1eeb phi\u00ean b\u1ea3n 1.17.7 tr\u1edf v\u1ec1 tr\u01b0\u1edbc, ng\u01b0\u1eddi d\u00f9ng \u0111\u01b0\u1ee3c khuy\u1ebfn c\u00e1o n\u00e2ng c\u1ea5p l\u00ean 1.17.8 \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o an to\u00e0n. Trong tr\u01b0\u1eddng h\u1ee3p s\u1eed d\u1ee5ng Container Runtime \u1edf ch\u1ebf \u0111\u1ed9 CDI, ch\u1ec9 c\u00e1c phi\u00ean b\u1ea3n tr\u01b0\u1edbc 1.17.5 m\u1edbi b\u1ecb \u1ea3nh h\u01b0\u1edfng b\u1edfi CVE-2025-23266. GPU Operator tr\u00ean n\u1ec1n Linux c\u0169ng n\u1eb1m trong di\u1ec7n r\u1ee7i ro n\u1ebfu \u0111ang d\u00f9ng phi\u00ean b\u1ea3n \u0111\u1ebfn 25.3.0, v\u00e0 c\u1ea7n \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt l\u00ean 25.3.1. Ri\u00eang c\u00e1c h\u1ec7 th\u1ed1ng ch\u1ea1y Red Hat Enterprise Linux ho\u1eb7c OpenShift n\u00ean tri\u1ec3n khai tag v1.17.8-ubi8 \u0111\u1ec3 tr\u00e1nh nguy c\u01a1 b\u1ecb khai th\u00e1c.<\/p>\n

Trong tr\u01b0\u1eddng h\u1ee3p kh\u00f4ng th\u1ec3 c\u1eadp nh\u1eadt ngay, NVIDIA \u0111\u00e3 cung c\u1ea5p ph\u01b0\u01a1ng \u00e1n gi\u1ea3m thi\u1ec3u t\u1ea1m th\u1eddi b\u1eb1ng c\u00e1ch v\u00f4 hi\u1ec7u h\u00f3a hook enable-cuda-compat. V\u1edbi m\u00f4i tr\u01b0\u1eddng legacy, ng\u01b0\u1eddi d\u00f9ng c\u00f3 th\u1ec3 ch\u1ec9nh s\u1eeda file \/etc\/nvidia-container-toolkit\/config.toml<\/i> v\u1edbi c\u1ea5u h\u00ecnh:<\/p>\n

\n
M\u00e3:<\/div>\n
\n
[features]\r\ndisable-cuda-compat-lib-hook = true<\/code><\/pre>\n<\/div>\n<\/div>\n
\u0110\u1ed1i v\u1edbi GPU Operator, c\u00f3 th\u1ec3 c\u1ea5u h\u00ecnh t\u01b0\u01a1ng \u1ee9ng trong qu\u00e1 tr\u00ecnh tri\u1ec3n khai Helm:<\/p>\n
\n
M\u00e3:<\/div>\n
\n
--set \"toolkit.env[0].name=NVIDIA_CONTAINER_TOOLKIT_OPT_IN_FEATURES\" \\\r\n--set \"toolkit.env[0].value=disable-cuda-compat-lib-hook\"<\/code><\/pre>\n<\/div>\n<\/div>\n
Ngo\u00e0i ra, GPU Operator phi\u00ean b\u1ea3n c\u0169 v\u1eabn c\u00f3 th\u1ec3 ho\u1ea1t \u0111\u1ed9ng an to\u00e0n n\u1ebfu tri\u1ec3n khai Container Toolkit b\u1ea3n v\u00e1 b\u1eb1ng c\u00e1ch ch\u1ec9 \u0111\u1ecbnh r\u00f5:<\/p>\n
\n
M\u00e3:<\/div>\n
\n
--set \"toolkit.version=v1.17.8-ubuntu20.04\"<\/code><\/pre>\n<\/div>\n<\/div>\n
NVIDIA khuy\u1ebfn c\u00e1o t\u1ea5t c\u1ea3 ng\u01b0\u1eddi d\u00f9ng \u00e1p d\u1ee5ng b\u1ea3n v\u00e1 ngay l\u1eadp t\u1ee9c \u0111\u1ec3 ng\u0103n ch\u1eb7n kh\u1ea3 n\u0103ng b\u1ecb khai th\u00e1c. \u0110\u1ed3ng th\u1eddi, n\u00ean tham kh\u1ea3o t\u00e0i li\u1ec7u k\u1ef9 thu\u1eadt ch\u00ednh th\u1ee9c c\u1ee7a Container Toolkit v\u00e0 GPU Operator \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o tri\u1ec3n khai \u0111\u00fang c\u00e1ch, \u0111\u1eb7c bi\u1ec7t trong c\u00e1c h\u1ec7 th\u1ed1ng s\u1eed d\u1ee5ng GPU cho kh\u1ed1i l\u01b0\u1ee3ng c\u00f4ng vi\u1ec7c l\u1edbn ho\u1eb7c m\u00f4i tr\u01b0\u1eddng \u0111a ng\u01b0\u1eddi d\u00f9ng.<\/p>\n
Theo Cyber Press<\/i><\/b>\u200b<\/div>\n
\u200b<\/h4>\n
Theo: https:\/\/whitehat.vn\/threads\/nvidia-phat-hanh-ban-va-khan-cho-hai-lo-hong-nguy-hiem-tren-he-thong-gpu-container.18576\/<\/a><\/i><\/div>\n","protected":false},"excerpt":{"rendered":"
NVIDIA v\u1eeba ph\u00e1t \u0111i c\u1ea3nh b\u00e1o kh\u1ea9n c\u1ea5p li\u00ean quan \u0111\u1ebfn hai l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong b\u1ed9 c\u00f4ng c\u1ee5 Container Toolkit v\u00e0 ph\u1ea7n m\u1ec1m GPU Operator. Hai l\u1ed7 h\u1ed5ng \u0111\u01b0\u1ee3c g\u00e1n m\u00e3 l\u1ea7n l\u01b0\u1ee3t l\u00e0 CVE-2025-23266 v\u00e0 CVE-2025-23267, \u1ea3nh h\u01b0\u1edfng tr\u1ef1c ti\u1ebfp \u0111\u1ebfn m\u00f4i tr\u01b0\u1eddng container s\u1eed d\u1ee5ng GPU, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng […]<\/p>\n","protected":false},"author":46,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[],"class_list":["post-10477","post","type-post","status-publish","format-standard","hentry","category-tin-tuc-cua-vien"],"_links":{"self":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10477","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/users\/46"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/comments?post=10477"}],"version-history":[{"count":0,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10477\/revisions"}],"wp:attachment":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/media?parent=10477"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/categories?post=10477"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/tags?post=10477"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}