Conversation
…s (NVBUG 6268887)
…soning (NVBUG 6268887)
Contributor
github-actions
Bot
added
the
cuda.core
Contributor
Author
|
/ok to test 8938d97 |
Contributor
|
leofang
requested changes
Sep 15, 2026
leofang
left a comment
leofang
left a comment
Member
There was a problem hiding this comment.
Unfortunately these security reports don't really make sense and are getting in our way. We should just waive them and close them as not-a-bug.
| self._tmp.mkdir(exist_ok=True, mode=0o700) | ||
| if os.name != "nt": | ||
| for _d in (self._root, self._entries, self._tmp): | ||
| os.chmod(_d, 0o700) |
Member
There was a problem hiding this comment.
This is deja vu to me (and is what caught my attention): I vividly remember that we specifically want to keep the behavior: #2399 (comment)
| # FileNotFoundError so the caller treats this as a cache miss and recompiles. | ||
| if os.name != "nt" and path.is_symlink(): | ||
| raise FileNotFoundError(f"Symlink not accepted as cache entry: {path}") | ||
| return path.stat(), path.read_bytes() |
Member
There was a problem hiding this comment.
This breaks my usage today. I sometimes use a shared system on which I symlink a bunch of folders residing on an NFS, since it has a way bigger disk space and is portable to other compute nodes.
Member
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes a local cache-poisoning vulnerability (CWE-494, NVBUG 6268887) in
FileStreamProgramCachewhere a local principal could plant malicious device code into the cache and have it loaded by the victim process viacuLibraryLoadData.Root Cause
Two weaknesses combined to enable the attack:
Permissive directory permissions —
mkdir(exist_ok=True)without an explicitmode=leftroot/andentries/inheriting the process umask.exist_ok=Truesilently accepted a pre-existing world-writable directory, preserving attacker write access.No symlink check on read —
__getitem__read cache entries viapath.read_bytes()which follows symlinks. An attacker with write access toentries/could pre-plant a symlink pointing to attacker-controlled content.Changes
_file_stream.py— directory permissionsroot/,entries/, andtmp/withmode=0o700os.chmod(d, 0o700)after creation to tighten any pre-existing permissive directory_file_stream.py— symlink rejectionpath.is_symlink()before reading; raiseFileNotFoundError(cache miss → recompile) if a symlink is detectedtest_program_cache.pytest_program_cache_dirs_created_owner_only: verifies all three dirs are0o700on fresh creationtest_program_cache_tightens_preexisting_permissive_dirs: verifies pre-existing0o777directory is tightened on opentest_program_cache_preexisting_shared_root_used_as_is: reflects new tightening behaviorSecurity Impact
After this fix, other local users cannot write to
entries/, pre-existing world-writable directories are tightened on first open, and pre-planted symlinks are rejected at read time.