Description

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-09-22T15:17:12.800Z",
  "pubdate": "2026-09-22T15:17:12.800Z",
  "executiveSummary": "The NVIDIA Infrastructure Controller for Linux is susceptible to a vulnerability involving improper neutralization of special elements used in a file path (CWE-73: External Control of File Name or Path).\nThis vulnerability allows an unauthenticated or low-privileged attacker to influence file system operations, potentially resulting in unauthorized file access, modification, or execution.\nThe successful exploitation of this flaw can lead to severe security compromises, including arbitrary code execution, privilege escalation, data tampering, and system-wide denial of service.\nGiven the nature of the Infrastructure Controller, the potential for lateral movement within a high-performance computing or data center environment is significant.\nDefensive measures require stringent input validation of all path-related parameters and strict enforcement of least-privilege principles for the service account running the controller.",
  "technicalDetails": "The vulnerability resides in the input processing logic of the NVIDIA Infrastructure Controller for Linux, specifically where user-supplied input is utilized to construct file system paths without adequate validation or sanitization.\nRoot Cause: The flaw stems from insufficient boundary checking and input normalization. The application fails to prevent directory traversal sequences (such as '../') or absolute path overrides when processing requests that specify file names or system paths.\nExploitation Method: An attacker can manipulate path parameters provided to the controller’s interface to bypass intended directory restrictions. By injecting path traversal sequences, an attacker can coerce the controller into operating on sensitive system files, configuration files, or executable binaries located outside the designated secure storage or operating directory.\nAttack Flow: (1) The attacker identifies an interface within the Infrastructure Controller that accepts file or path input as an argument. (2) The attacker sends a crafted request containing malicious path traversal strings. (3) The application’s internal function logic improperly handles the input, failing to sanitize or canonicalize the path before passing it to underlying OS file APIs (e.g., fopen, open, or execve). (4) The operating system executes the requested action on the target file as determined by the injected path.\nImpact Analysis: If the controller executes with elevated privileges (e.g., root), the attacker may achieve arbitrary code execution by overwriting binaries or dynamic libraries. Furthermore, data tampering may involve the modification of system configurations to disable security controls. Denial of Service can be achieved by overwriting critical system files, rendering the Linux host unstable or inoperable.\nComplexity and Requirements: Exploitation generally does not require complex cryptographic bypasses but relies on the degree of privilege granted to the service component. The impact is maximized if the controller manages external inputs or interfaces exposed to untrusted network segments."
}