CudaBOM

Overview

Mon, 01 Jan 0001 00:00:00 +0000

Find the CUDA your SBOM missed. cudabom is an open-source Rust CLI that proves which NVIDIA CUDA software is actually inside an artifact (Python wheels, shared libraries, executables, and container images) and turns that evidence into security-grade SBOM, advisory, and VEX data. The question it answers: What CUDA is really inside this artifact, how do we know, and are we affected by any NVIDIA security bulletin? Built with

CUDA coverage

Mon, 01 Jan 0001 00:00:00 +0000

cudabom identifies CUDA components by matching an artifact’s content against fingerprints derived from NVIDIA’s own redistributable archives. This page is generated from the committed fingerprint database, so it always reflects exactly what the current build can recognize. 282 releases fingerprinted across 15 product trees, 20,127 file hashes across 45 component families. 9 earlier release(s) NVIDIA lists carry no redistributable libraries (the CUDA redist program began at 11.4.2), so they hold no fingerprints and are omitted below.

CLI reference

Mon, 01 Jan 0001 00:00:00 +0000

Generated from cudabom --help, so it always matches the built binary. Exit codes: 0 success, 1 policy/threshold violation, 2 usage error, 3 input error, 4 internal error. cudabom Find the CUDA your SBOM missed: evidence-backed CUDA identity and security-grade SBOM/VEX for artifacts. Usage: cudabom [OPTIONS] Commands: scan Scan one or more targets for CUDA components gate Scan targets and evaluate a policy, failing the build on violations enrich Enrich an existing CycloneDX SBOM with discovered CUDA components vex Emit CycloneDX VEX for a target reconcile Reconcile a declared CycloneDX SBOM/VEX (e.g. from NGC) against the CUDA components cudabom discovers in a target explain Explain why a finding was identified db Manage the local advisory database update Fetch the published data bundle (fingerprint DB + advisory index) into the local data directory that scans read by default schema Print the JSON Schema of cudabom's native output version Print version information for the tool and its data help Print this message or the help of the given subcommand(s) Options: -v, --verbose... Increase diagnostic detail on stderr. Repeat for more (`-vv`). This is the single knob for verbosity across every subcommand; it never changes the machine-readable output written to stdout or `--output` -q, --quiet Suppress non-essential diagnostics on stderr, leaving only errors. Like `--verbose`, this is global and does not affect stdout output -h, --help Print help -V, --version Print version cudabom scan Scan one or more targets for CUDA components Usage: cudabom scan [OPTIONS] ... Arguments: ... One or more targets to scan (files or directories) Options: --format Output format [default: table] [possible values: table, json, cyclonedx, sarif, markdown] -o, --output Write output to a file instead of stdout --db Path to a fingerprint database (JSON) used for identification. When omitted, an empty database is used, so only structural signals produce findings --advisories Path to a local advisory index (JSON) used to correlate findings against known NVIDIA security advisories. When omitted, no advisory correlation is performed. Absence of a match is never treated as proof of safety --fail-on When to return a non-zero exit code. `scan` is a reporting command and defaults to `none` (exit 0 on success) so identifying CUDA does not fail a build; use `found` or `affected` to opt into CI failure, or `gate` for full policy enforcement Possible values: - none: Never fail on results (always exit 0 on success). The default - found: Fail when any CUDA component is identified (regardless of advisories) - affected: Fail only when an identified component is `affected` by an advisory [default: none] --all-files List every file walked in the `table` output, including the uninteresting ones (source headers, package metadata). By default the table shows only files that carry a signal (ELF, GPU code, archives, parse errors) and collapses the rest into a one-line summary. Only affects `--format table` -v, --verbose... Increase diagnostic detail on stderr. Repeat for more (`-vv`). This is the single knob for verbosity across every subcommand; it never changes the machine-readable output written to stdout or `--output` -q, --quiet Suppress non-essential diagnostics on stderr, leaving only errors. Like `--verbose`, this is global and does not affect stdout output -h, --help Print help (see a summary with '-h') -V, --version Print version cudabom gate Scan targets and evaluate a policy, failing the build on violations Usage: cudabom gate [OPTIONS] ... Arguments: ... One or more targets to scan (files or directories) Options: --policy Path to a policy file (JSON). When omitted, the built-in secure default is used: fail on any `affected` advisory verdict --db Path to a fingerprint database (JSON) used for identification --advisories Path to a local advisory index (JSON) used to correlate findings --format Output format for the gate decision [default: table] [possible values: table, json] -v, --verbose... Increase diagnostic detail on stderr. Repeat for more (`-vv`). This is the single knob for verbosity across every subcommand; it never changes the machine-readable output written to stdout or `--output` -q, --quiet Suppress non-essential diagnostics on stderr, leaving only errors. Like `--verbose`, this is global and does not affect stdout output -h, --help Print help -V, --version Print version cudabom enrich Enrich an existing CycloneDX SBOM with discovered CUDA components Usage: cudabom enrich [OPTIONS] --sbom ... Arguments: ... One or more targets to scan for CUDA components to add Options: --sbom The existing CycloneDX SBOM (JSON) to enrich --db Path to a fingerprint database (JSON) used for identification -o, --output Write the enriched SBOM to a file instead of stdout -v, --verbose... Increase diagnostic detail on stderr. Repeat for more (`-vv`). This is the single knob for verbosity across every subcommand; it never changes the machine-readable output written to stdout or `--output` -q, --quiet Suppress non-essential diagnostics on stderr, leaving only errors. Like `--verbose`, this is global and does not affect stdout output -h, --help Print help -V, --version Print version cudabom vex Emit CycloneDX VEX for a target Usage: cudabom vex [OPTIONS] ... Arguments: ... One or more targets to scan (files or directories) Options: --db Path to a fingerprint database (JSON) used for identification --advisories Path to a local advisory index (JSON). VEX statements come from the resulting advisory verdicts; without it, the VEX document has an SBOM but no vulnerability statements -o, --output Write output to a file instead of stdout -v, --verbose... Increase diagnostic detail on stderr. Repeat for more (`-vv`). This is the single knob for verbosity across every subcommand; it never changes the machine-readable output written to stdout or `--output` -q, --quiet Suppress non-essential diagnostics on stderr, leaving only errors. Like `--verbose`, this is global and does not affect stdout output -h, --help Print help -V, --version Print version cudabom reconcile Reconcile a declared CycloneDX SBOM/VEX (e.g. from NGC) against the CUDA components cudabom discovers in a target Usage: cudabom reconcile [OPTIONS] ... Arguments: ... One or more targets to scan (files or directories) Options: --sbom A declared CycloneDX SBOM (JSON) to reconcile against, e.g. the SBOM NGC publishes for an image. May be combined with `--vex` --vex A declared CycloneDX VEX (JSON) to reconcile against, e.g. the VEX NGC publishes for an image. VEX statements are attached to matched components --ngc-image Fetch the declared SBOM and VEX from NVIDIA NGC for this image, given as `org/repository:tag` (e.g. `nvidia/pytorch:26.01-py3`). Requires an NGC API key in `--ngc-api-key` or the `NGC_API_KEY` environment variable. This is the only networked path; `--sbom`/`--vex` files stay offline --ngc-api-key NGC API key for `--ngc-image`. Falls back to the `NGC_API_KEY` environment variable, which is preferred so the key stays out of shell history and process listings --db Path to a fingerprint database (JSON) used for identification --format Output format [default: table] [possible values: table, json, cyclonedx, sarif, markdown] -o, --output Write output to a file instead of stdout -v, --verbose... Increase diagnostic detail on stderr. Repeat for more (`-vv`). This is the single knob for verbosity across every subcommand; it never changes the machine-readable output written to stdout or `--output` -q, --quiet Suppress non-essential diagnostics on stderr, leaving only errors. Like `--verbose`, this is global and does not affect stdout output -h, --help Print help -V, --version Print version cudabom explain Explain why a finding was identified Usage: cudabom explain [OPTIONS] ... Arguments: ... One or more targets to scan (files or directories) Options: --id The finding id to explain. When omitted, all findings are listed with their ids so one can be chosen --db Path to a fingerprint database (JSON) used for identification --format Output format [default: text] [possible values: text, json] -v, --verbose... Increase diagnostic detail on stderr. Repeat for more (`-vv`). This is the single knob for verbosity across every subcommand; it never changes the machine-readable output written to stdout or `--output` -q, --quiet Suppress non-essential diagnostics on stderr, leaving only errors. Like `--verbose`, this is global and does not affect stdout output -h, --help Print help -V, --version Print version cudabom db Manage the local advisory database Usage: cudabom db [OPTIONS] Commands: build Build a normalized advisory index from local CSAF documents status Report mapped and unmapped products from local CSAF documents update Fetch CSAF from upstream over the network and rebuild the index help Print this message or the help of the given subcommand(s) Options: -v, --verbose... Increase diagnostic detail on stderr. Repeat for more (`-vv`). This is the single knob for verbosity across every subcommand; it never changes the machine-readable output written to stdout or `--output` -q, --quiet Suppress non-essential diagnostics on stderr, leaving only errors. Like `--verbose`, this is global and does not affect stdout output -h, --help Print help -V, --version Print version cudabom update Fetch the published data bundle (fingerprint DB + advisory index) into the local data directory that scans read by default Usage: cudabom update [OPTIONS] Options: --tag Release tag to install (e.g. `v1.2.3`). When omitted, the latest release is resolved and installed --data-dir Install into this directory instead of the resolved per-user data directory (`$CUDABOM_DATA_DIR`, `$SNAP_USER_DATA/cudabom`, `$XDG_DATA_HOME/cudabom`, or `~/.local/share/cudabom`) --owner Repository owner the bundle is published from (defaults to the cudabom project) --repo Repository name (defaults to the cudabom project) --api-url Override the GitHub REST API base (release lookup), e.g. a mirror --download-url Override the release-asset download base URL --max-retries Maximum download attempts per request (including the first). Default 5 --retry-base-ms Base backoff in milliseconds for the first retry. Default 500 --no-retry Disable retries entirely (single attempt per request) -v, --verbose... Increase diagnostic detail on stderr. Repeat for more (`-vv`). This is the single knob for verbosity across every subcommand; it never changes the machine-readable output written to stdout or `--output` -q, --quiet Suppress non-essential diagnostics on stderr, leaving only errors. Like `--verbose`, this is global and does not affect stdout output -h, --help Print help -V, --version Print version cudabom schema Print the JSON Schema of cudabom's native output Usage: cudabom schema [OPTIONS] Options: -v, --verbose... Increase diagnostic detail on stderr. Repeat for more (`-vv`). This is the single knob for verbosity across every subcommand; it never changes the machine-readable output written to stdout or `--output` -q, --quiet Suppress non-essential diagnostics on stderr, leaving only errors. Like `--verbose`, this is global and does not affect stdout output -h, --help Print help -V, --version Print version cudabom version Print version information for the tool and its data Usage: cudabom version [OPTIONS] Options: -v, --verbose... Increase diagnostic detail on stderr. Repeat for more (`-vv`). This is the single knob for verbosity across every subcommand; it never changes the machine-readable output written to stdout or `--output` -q, --quiet Suppress non-essential diagnostics on stderr, leaving only errors. Like `--verbose`, this is global and does not affect stdout output -h, --help Print help -V, --version Print version

Architecture

Mon, 01 Jan 0001 00:00:00 +0000

cudabom is a Cargo workspace. Each crate owns one stage of the pipeline and depends only on what that stage needs, so the ELF parser does not drag in the archive stack and the reporting layer does not depend on the advisory database. Crates Crate Responsibility cudabom clap front end, output selection, exit codes cudabom-core shared types (Artifact, Location, Component, Evidence, Confidence, Finding) and tunable safety Limits cudabom-extract safe, streaming walkers for wheels, sdists, archives, directories, and container images cudabom-elf ELF facts: SONAME, NEEDED, symbols, symbol versions, build-id, sections, notes, rodata strings cudabom-fatbin fatbin/cubin/PTX parsing cudabom-identify fingerprint DB + matchers turning facts into CUDA identities with confidence cudabom-advisory NVIDIA CSAF ingestion, normalization, local index, matching cudabom-sbom CycloneDX 1.6 emit/enrich/merge, PEP 770 reader, VEX cudabom-report terminal table, native JSON, SARIF, Markdown renderers cudabom-policy policy-file evaluation for gate xtask fixture builds, fingerprint-DB builder, corpus evaluation (not shipped) Pipeline input -> extract (safe, streaming, bounded by Limits) -> per-file facts (ELF, fatbin, rodata strings) -> identify (evidence -> component identity + confidence) -> reconcile with declared SBOMs (PEP 770 / input SBOM) -> correlate advisories (local index) -> render outputs / evaluate policy Per-file facts are cached by content hash so re-scans and multi-layer container images are fast.

Evidence model

Mon, 01 Jan 0001 00:00:00 +0000

cudabom’s product is evidence-backed CUDA identity. Every reported component carries the observations that support it and an explicit confidence level. This document is the authoritative definition of the types and rules; the code in cudabom-core and cudabom-identify implements them. Evidence types Each evidence item records what was observed, where, and how strong it is. These types are validated against real binaries before they are trusted; do not add a type without a fixture that exercises it.

Gate policy

Mon, 01 Jan 0001 00:00:00 +0000

cudabom gate runs the scan pipeline and then evaluates a policy to decide whether the build should pass or fail. The policy is a small, reviewable JSON document. Run without --policy, gate uses a built-in secure default; a file only has to express how you deviate from it. The secure default With no --policy, the gate fails on any affected advisory verdict and nothing else: identification alone does not fail the build, and an under_investigation verdict warns but does not block (so a partial advisory index cannot wedge a pipeline). This is equivalent to:

Advisories

Mon, 01 Jan 0001 00:00:00 +0000

cudabom correlates identified CUDA components against NVIDIA’s machine-readable security bulletins and reports affected / not_affected / under_investigation verdicts with justifications. Source Primary: the NVIDIA Product Security GitHub repository (https://github.com/NVIDIA/product-security), using its machine-readable CSAF/CVE data where available. Source of record: https://www.nvidia.com/en-us/product-security/. NVIDIA’s guidance states that from October 1, 2026 its PSIRT publishes bulletins on GitHub in Markdown, CSAF, and CVE formats. Historical coverage may be incomplete during the migration; cudabom exposes advisory coverage status rather than treating missing historical data as proof of safety.

Advisory coverage

Mon, 01 Jan 0001 00:00:00 +0000

cudabom correlates identified CUDA versions against a normalized index built from NVIDIA’s machine-readable (CSAF) security bulletins. This page is generated from the committed advisory index. 76 advisories indexed from NVIDIA CSAF (source commit 2c9454053cf5), with 152 reference links across 76 of them. By severity Severity Advisories HIGH 28 MEDIUM 29 LOW 19 Indexed advisories CVE Severity CVSS Affected Fixed in CVE-2025-23254 HIGH 8.8 tensorrt 0.18.2 CVE-2026-24233 HIGH 8.4 tensorrt 1.3.0 CVE-2026-24188 HIGH 8.2 tensorrt 10.16.1 CVE-2022-21821 HIGH 7.8 cuda-toolkit 11.6.2 CVE-2026-24238 HIGH 7.8 tensorrt 11.0 CVE-2026-24268 HIGH 7.8 tensorrt 11.0 CVE-2026-24272 HIGH 7.8 tensorrt 11.0 CVE-2026-47472 HIGH 7.8 tensorrt 1.3.0 CVE-2025-33255 HIGH 7.5 tensorrt 1.2 CVE-2026-24163 HIGH 7.5 tensorrt 1.2 CVE-2026-47471 HIGH 7.5 tensorrt 1.3.0 CVE-2026-47473 HIGH 7.4 tensorrt 1.3.0 CVE-2025-33228 HIGH 7.3 cuda-toolkit - CVE-2025-33229 HIGH 7.3 cuda-toolkit - CVE-2025-33230 HIGH 7.3 cuda-toolkit - CVE-2026-24229 HIGH 7.3 tensorrt 1.3.0 CVE-2026-24234 HIGH 6.8 tensorrt 1.3.0 CVE-2025-33231 HIGH 6.7 cuda-toolkit - CVE-2026-24205 HIGH 6.4 tensorrt 1.2.1 CVE-2026-24220 HIGH 6.4 tensorrt 1.3.0 CVE-2026-24259 HIGH 6.4 tensorrt 1.3.0 CVE-2026-24142 HIGH 6.3 tensorrt 1.2 CVE-2026-24226 HIGH 6.3 tensorrt 1.3.0 CVE-2026-24271 HIGH 6.2 tensorrt 1.3.0 CVE-2026-47470 HIGH 6.2 tensorrt 1.3.0 CVE-2026-47475 HIGH 6.2 tensorrt 1.3.0 CVE-2026-24160 HIGH 5.5 tensorrt 1.2 CVE-2026-24227 HIGH 5.3 tensorrt 11.0 CVE-2024-0142 MEDIUM 6.8 nvjpeg2000 0.8.1 CVE-2024-0143 MEDIUM 6.8 nvjpeg2000 0.8.1 CVE-2024-0144 MEDIUM 6.8 nvjpeg2000 0.8.1 CVE-2024-0145 MEDIUM 6.8 nvjpeg2000 0.8.1 CVE-2025-23272 MEDIUM 5.7 cuda-toolkit, nvjpeg - CVE-2026-65122 MEDIUM 5.5 tensorrt 11.2 CVE-2023-25512 MEDIUM 5.3 cuda-toolkit 12.1 CVE-2023-25513 MEDIUM 5.3 cuda-toolkit 12.0.1 CVE-2023-25514 MEDIUM 5.3 cuda-toolkit 12.1.1 CVE-2025-23274 MEDIUM 4.5 cuda-toolkit, nvjpeg - CVE-2022-34667 MEDIUM 4.4 cuda-toolkit 11.8 CVE-2023-0193 MEDIUM 4.4 cuda-toolkit 12.1 CVE-2024-0110 MEDIUM 4.4 cuda-toolkit - CVE-2024-0111 MEDIUM 4.4 cuda-toolkit - CVE-2025-23247 MEDIUM 4.4 cuda-toolkit - CVE-2025-23275 MEDIUM 4.2 cuda-toolkit, nvjpeg - CVE-2023-0196 MEDIUM 3.3 cuda-toolkit 12.1 CVE-2023-25510 MEDIUM 3.3 cuda-toolkit 12.1.1 CVE-2023-25511 MEDIUM 3.3 cuda-toolkit 12.1.1 CVE-2024-0109 MEDIUM 3.3 cuda-toolkit - CVE-2025-23248 MEDIUM 3.3 cuda-toolkit - CVE-2025-23255 MEDIUM 3.3 cuda-toolkit - CVE-2025-23271 MEDIUM 3.3 cuda-toolkit - CVE-2025-23308 MEDIUM 3.3 cuda-toolkit - CVE-2025-23338 MEDIUM 3.3 cuda-toolkit - CVE-2025-23339 MEDIUM 3.3 cuda-toolkit - CVE-2025-23340 MEDIUM 3.3 cuda-toolkit - CVE-2025-23346 MEDIUM 3.3 cuda-toolkit - CVE-2025-23273 MEDIUM 2.5 cuda-toolkit, nvjpeg - CVE-2023-25523 LOW 3.3 cuda-toolkit - CVE-2024-0072 LOW 3.3 cuda-toolkit - CVE-2024-0076 LOW 3.3 cuda-toolkit - CVE-2024-0102 LOW 3.3 cuda-toolkit - CVE-2024-0123 LOW 3.3 cuda-toolkit - CVE-2024-0124 LOW 3.3 cuda-toolkit - CVE-2024-0125 LOW 3.3 cuda-toolkit - CVE-2024-53870 LOW 3.3 cuda-toolkit - CVE-2024-53871 LOW 3.3 cuda-toolkit - CVE-2024-53872 LOW 3.3 cuda-toolkit - CVE-2024-53873 LOW 3.3 cuda-toolkit - CVE-2024-53874 LOW 3.3 cuda-toolkit - CVE-2024-53875 LOW 3.3 cuda-toolkit - CVE-2024-53876 LOW 3.3 cuda-toolkit - CVE-2024-53877 LOW 3.3 cuda-toolkit - CVE-2023-31028 LOW 2.8 nvjpeg2000 - CVE-2024-0080 LOW 2.8 nvtiff - CVE-2024-53878 LOW 2.8 cuda-toolkit - CVE-2024-53879 LOW 2.8 cuda-toolkit -

Data sources

Mon, 01 Jan 0001 00:00:00 +0000

cudabom is grounded in first-party, machine-readable NVIDIA data. This document records the sources cudabom uses, what each is authoritative for, and how each feeds the tool. The guiding principle: cudabom does not invent fingerprints or advisories, so every claim traces back to one of these sources. Two rules apply across all of them: Never commit NVIDIA binaries. Archives are fetched into gitignored scratch (corpus/), verified against NVIDIA’s published SHA-256, inspected, and only the derived facts (hashes, build-ids, SONAME stems) are committed. Scanning is offline by default. Network access is confined to explicit, developer/CI-time refresh steps (cargo xtask corpus …, cudabom db update). A normal cudabom scan needs no network. Source hierarchy Source Authoritative for cudabom use CUDA redistributable JSON manifests Canonical component/release inventory, versions, platforms, archive paths, SHA-256, sizes Fingerprint corpus generation; release/component discovery; provenance Jetson (L4T/JetPack) APT repository Tegra aarch64 CUDA package inventory, versions, pool paths, SHA-256 Jetson fingerprint corpus (synthesized redist manifests) CUDA package repositories (APT/deb, rpm) OS package inventory and historical versions OS package/version mapping (future) NVIDIA Repo Channels / CDN (releases.json) Content-addressed artifact acquisition Future-proof download resolution (investigate) NVIDIA Product Security (CSAF/CVE) Security advisories Advisory correlation / VEX (cudabom db update) NGC catalog + HTTP APIs Container metadata, declared SBOM/VEX, scan results Real-world evaluation; declared-vs-discovered reconciliation (cudabom reconcile) CUDA binary utilities / PTX ISA / programming guide docs Format and semantics reference Parser/reference validation, not a runtime dependency CUDA redistributable manifests (canonical) Base: https://developer.download.nvidia.com/compute/cuda/redist/ Per-release: .../redist/redistrib_.json

Comparison

Mon, 01 Jan 0001 00:00:00 +0000

cudabom is not a replacement for general SBOM and binary-analysis tools; it specializes in CUDA identity. This document compares cudabom against Syft, Trivy, and OWASP blint on the same corpus, built by actually running current versions of each. It is meant to be fair, including where the other tools do better. Method cargo xtask eval runs each tool against the labeled corpus and records what each finds, what only cudabom finds, and what cudabom misses. The corpus and its ground-truth labels are described in ../CONTRIBUTING.md.

Threat model

Mon, 01 Jan 0001 00:00:00 +0000

cudabom consumes attacker-controlled files: wheels, shared libraries, executables, and container images pulled from untrusted sources. Resisting hostile input without crashing or escaping is a primary requirement. Trust boundary Everything cudabom scans is untrusted. cudabom itself, its fingerprint database, and its advisory index are trusted (the index is verified on db update). Enforced properties No execution. cudabom never executes, loads (dlopen), or JIT-compiles anything it scans. It only reads and parses bytes. No network except the explicit refresh/fetch commands (cudabom db update, cudabom update, and reconcile --ngc-image). A scan makes no network connections; the security verdict never depends on a reachable website. Safe extraction. No path traversal, no symlink following outside the virtual root, no absolute paths, no writing to disk unless a temp dir is strictly required (prefer in-memory/streaming). Bounded work. Configurable hard limits cap nesting depth, total bytes, per-file bytes, decompression ratio, entries per archive, and per-file parse time. These live in one tunable place: the Limits struct in crates/cudabom-core/src/config.rs. Panic-free parsers. Malformed input yields an error, never a crash. Every parser has a fuzz target under fuzz/ and short fuzz jobs run in CI. No unsafe. #![forbid(unsafe_code)] in all crates; any exception is justified in DECISIONS.md. Attack scenarios and mitigations Scenario Mitigation Zip/tar bomb per-file and total byte caps; decompression-ratio cap Deeply nested archive nesting-depth cap Path traversal (../../etc) skip the entry (never written, so no escape); keep scanning siblings Symlink escape do not follow symlinks outside the virtual root Malformed ELF/fatbin crashing the parser panic-free parsing; fuzzing Hostile CSAF/SBOM input validated parsing; bounded sizes Supply chain of cudabom itself SHA-pinned GitHub Actions on hardened runners, cargo-audit and cargo-deny gates, CodeQL, OpenSSF Scorecard, and releases signed with SLSA Build Level 3 provenance and Sigstore. See ../SECURITY.md.