Critical NVIDIA Container Toolkit Flaw Allows Privilege Escalation on AI Cloud Services
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-0132 | TOCTOU Flaw in NVIDIA Container Toolkit Grants Host Filesystem Access from Containers NVIDIA Container Toolkit versions 1.16.1 and earlier contain a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) that, with the default configuration, allows a specifically crafted container image to gain access to the host file system. The flaw is triggered when a vulnerable toolkit prepares GPU resources for a running container, so environments that execute attacker- or user-supplied images — such as multi-tenant AI platforms and shared GPU clusters — face the greatest risk, while deployments using CDI mode are explicitly not affected. A successful exploit can lead to code execution, escalation of privileges, information disclosure, data tampering, or denial of service on the host. Affected operators include those running the toolkit standalone and those deploying it through the NVIDIA GPU Operator. No confirmed in-the-wild exploitation is documented (not in CISA KEV), but headlines indicate researchers demonstrated working exploits, including one bypassing the initial patch, and EPSS assigns a 40.8% probability of exploitation within 30 days (99th percentile). Do: Upgrade NVIDIA Container Toolkit to a fixed release newer than 1.16.1 and update NVIDIA GPU Operator deployments so they bundle the fixed toolkit; because researchers demonstrated a bypass of the initial patch, confirm the latest vendor release is installed. Where feasible, switch the container runtime to CDI mode, which is not affected by this flaw, and restrict GPU hosts to running trusted images. Review hosts that have run untrusted or user-submitted images for signs of compromise. | 8.3 | 41% |
| masson the order of 1M+ GPU-accelerated host installations, though only a subset run untrusted images (exact counts unknown) | ||
| CVE-2025-23266 | NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary co NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial of service. NVD description · AI analysis pending | 9.0 | 3% | — | — | ||
| CVE-2025-23359 | NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container i NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. NVD description · AI analysis pending | 8.1 | 4% | PoC |
| — |
Full article522 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJul 18, 2025Cloud Security / AI Security
Cybersecurity researchers have disclosed a critical container escape vulnerability in the NVIDIA Container Toolkit that could pose a severe threat to managed AI cloud services.
The vulnerability, tracked as CVE-2025-23266, carries a CVSS score of 9.0 out of 10.0. It has been codenamed NVIDIAScape by Google-owned cloud security company Wiz.
"NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions," NVIDIA said in an advisory for the bug.
"A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial-of-service."
The shortcoming impacts all versions of NVIDIA Container Toolkit up to and including 1.17.7 and NVIDIA GPU Operator up to and including 25.3.0. It has been addressed by the GPU maker in versions 1.17.8 and 25.3.1, respectively.
The NVIDIA Container Toolkit refers to a collection of libraries and utilities that enable users to build and run GPU-accelerated Docker containers. The NVIDIA GPU Operator is designed to deploy these containers automatically on GPU nodes in a Kubernetes cluster.
Wiz, which shared details of the flaw in a Thursday analysis, said the shortcoming affects 37% of cloud environments, allowing an attacker to potentially access, steal, or manipulate the sensitive data and proprietary models of all other customers running on the same shared hardware by means of a three-line exploit.
The vulnerability stems from a misconfiguration in how the toolkit handles the Open Container Initiative (OCI) hook "createContainer." A successful exploit for CVE-2025-23266 can result in a complete takeover of the server. Wiz also characterized the flaw as "incredibly" easy to weaponize.
"By setting LD_PRELOAD in their Dockerfile, an attacker could instruct the nvidia-ctk hook to load a malicious library," Wiz researchers Nir Ohfeld and Shir Tamari added.
"Making matters worse, the createContainer hook executes with its working directory set to the container's root filesystem. This means the malicious library can be loaded directly from the container image with a simple path, completing the exploit chain."
All of this can be achieved with a "stunningly simple three-line Dockerfile" that loads the attacker's shared object file into a privileged process, resulting in a container escape.
The disclosure comes a couple of months after Wiz detailed a bypass for another vulnerability in NVIDIA Container Toolkit (CVE-2024-0132, CVSS score: 9.0 and CVE-2025-23359, CVSS score: 8.3) that could have been abused to achieve complete host takeover.
"While the hype around AI security risks tends to focus on futuristic, AI-based attacks, 'old-school' infrastructure vulnerabilities in the ever-growing AI tech stack remain the immediate threat that security teams should prioritize," Wiz said.
"Additionally, this research highlights, not for the first time, that containers are not a strong security barrier and should not be relied upon as the sole means of isolation. When designing applications, especially for multi-tenant environments, one should always 'assume a vulnerability' and implement at least one strong isolation barrier, such as virtualization."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/07/critical-nvidia-container-toolkit-flaw.html