NVIDIA CUDA Toolkit - cuobjdump: A stack-based buffer overflow on a malformed input file yields limited denial

Impact

A stack-based buffer overflow on a malformed input file yields limited denial of service and data-integrity loss for the invoking user. The realistic exposure is your build and profiling pipeline, not your runtime fleet: anything that automatically disassembles third-party fatbins, vendor kernels or model artifacts is running this parser on attacker-influenced input.

Who can reach it

Local, and requires a user or an automated job to run cuobjdump over an attacker-supplied file. CI jobs that inspect third-party CUDA binaries are the usual path.

What to do

Update the CUDA Toolkit package (bulletin 5373). Cost: effectively zero - userspace SDK only, no driver reload, no node drain, no running-job impact. Rebuild build/CI images and move on.

References