Incomplete Patch in NVIDIA Toolkit Leaves CVE-2024
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-0132 | TOCTOU Flaw in NVIDIA Container Toolkit Grants Host Filesystem Access from Containers NVIDIA Container Toolkit versions 1.16.1 and earlier contain a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) that, with the default configuration, allows a specifically crafted container image to gain access to the host file system. The flaw is triggered when a vulnerable toolkit prepares GPU resources for a running container, so environments that execute attacker- or user-supplied images — such as multi-tenant AI platforms and shared GPU clusters — face the greatest risk, while deployments using CDI mode are explicitly not affected. A successful exploit can lead to code execution, escalation of privileges, information disclosure, data tampering, or denial of service on the host. Affected operators include those running the toolkit standalone and those deploying it through the NVIDIA GPU Operator. No confirmed in-the-wild exploitation is documented (not in CISA KEV), but headlines indicate researchers demonstrated working exploits, including one bypassing the initial patch, and EPSS assigns a 40.8% probability of exploitation within 30 days (99th percentile). Do: Upgrade NVIDIA Container Toolkit to a fixed release newer than 1.16.1 and update NVIDIA GPU Operator deployments so they bundle the fixed toolkit; because researchers demonstrated a bypass of the initial patch, confirm the latest vendor release is installed. Where feasible, switch the container runtime to CDI mode, which is not affected by this flaw, and restrict GPU hosts to running trusted images. Review hosts that have run untrusted or user-submitted images for signs of compromise. | 8.3 | 41% |
| masson the order of 1M+ GPU-accelerated host installations, though only a subset run untrusted images (exact counts unknown) | ||
| CVE-2025-23359 | NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container i NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. NVD description · AI analysis pending | 8.1 | 4% | PoC |
| — |
Full article471 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananApr 10, 2025Container Security / Vulnerability
Cybersecurity researchers have detailed a case of an incomplete patch for a previously addressed security flaw impacting the NVIDIA Container Toolkit that, if successfully exploited, could put sensitive data at risk.
The original vulnerability CVE-2024-0132 (CVSS score: 9.0) is a Time-of-Check Time-of-Use (TOCTOU) vulnerability that could lead to a container escape attack and allow for unauthorized access to the underlying host.
While this flaw was resolved by NVIDIA in September 2024, a new analysis by Trend Micro has revealed the fix to be incomplete and that there also exists a related performance flaw affecting Docker on Linux that could result in a denial-of-service (DoS) condition.
"These issues could enable attackers to escape container isolation, access sensitive host resources, and cause severe operational disruptions," Trend Micro researcher Abdelrahman Esmail said in a new report published today.
The fact that the TOCTOU vulnerability persists means that a specially crafted container could be abused to access the host file system and execute arbitrary commands with root privileges. The flaw impacts version 1.17.4 if the feature allow-cuda-compat-libs-from-container is explicitly enabled.
"The specific flaw exists within the mount_files function," Trend Micro said. "The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the host."
However, for this privilege escalation to work, the attacker must have already obtained the ability to execute code within a container.
The shortcoming has been assigned the CVE identifier CVE-2025-23359 (CVSS score: 9.0), which was previously flagged by cloud security firm Wiz as also a bypass for CVE-2024-0132 back in February 2025. It has been addressed in version 1.17.4.
The cybersecurity company said it also discovered a performance issue during the analysis of the CVE-2024-0132 that could potentially lead to a DoS vulnerability on the host machine. It affects Docker instances on Linux systems.
"When a new container is created with multiple mounts configured using (bind-propagation=shared), multiple parent/child paths are established. However, the associated entries are not removed in the Linux mount table after container termination," Esmail said.
"This leads to a rapid and uncontrollable growth of the mount table, exhausting available file descriptors (fd). Eventually, Docker is unable to create new containers due to fd exhaustion. This excessively large mount table leads to a huge performance issue, preventing users from connecting to the host (i.e., via SSH)."
To mitigate the issue, it's advised to monitor the Linux mount table for abnormal growth, limit Docker API access to authorized personnel, enforce strong access control policies, and conduct periodic audits of container-to-host filesystem bindings, volume mounts, and socket connections.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/04/incomplete-patch-in-nvidia-toolkit.html