CVE-2023-31036: CVE
NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option --model-control explicit, an attacker may use the model load API to cause a relative path traversal. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-31036?
CVE-2023-31036 is a high-severity vulnerability that allows relative path traversal in NVIDIA Triton Inference Server.
How do I fix CVE-2023-31036?
To mitigate CVE-2023-31036, avoid using the --model-control explicit command line option if possible.
What versions of NVIDIA Triton Inference Server are affected by CVE-2023-31036?
NVIDIA Triton Inference Server versions up to 2.40 are affected by CVE-2023-31036.
What is the impact of exploiting CVE-2023-31036?
Exploitation of CVE-2023-31036 may allow an attacker to manipulate model loading through relative path traversal.
Is there a workaround for CVE-2023-31036?
A potential workaround for CVE-2023-31036 is to review and adjust the model loading configurations to prevent unauthorized access.