Intel Gaudi / gaudi-container-runtime: MULTI-TENANT ISOLATION: A path-traversal bug in the container runtime shim

Impact

MULTI-TENANT ISOLATION: A path-traversal bug in the container runtime shim that wires Gaudi devices into containers lets a tenant who controls the container spec cause the runtime to touch host paths outside the container root. On a shared Gaudi box the runtime executes as root on the host, so this is the classic accelerator-runtime escape shape: tenant container -> host filesystem -> every other tenant's job on that node.

Who can reach it

Any tenant who can launch a container on a Gaudi node through the normal scheduler. No host account and no physical access required - the container spec is the attack surface.

What to do

Upgrade gaudi-container-runtime to 1.24.0 or later across every Gaudi node. This is a host-side userspace package, so no BIOS, firmware or microcode update is involved, but the runtime binary is in the path of every new container start - roll it per node and restart the container engine, which means draining running jobs on that node.

References