A security vulnerability, CVE-2025-23359, has been identified in the NVIDIA Container Toolkit. This is a bypass of the original patch for CVE-2024-0132. The vulnerability was discovered by Wiz Research.

The vulnerability, identified as CVE-2025-23359, is a bypass of a previous vulnerability (CVE-2024-0132) in the NVIDIA Container Toolkit. It involves a Time-of-Check Time-of-Use (TOCTOU) vulnerability. By manipulating file paths with a symbolic link during mount operations, an attacker can mount the host's root file system into a container, gaining unrestricted access. Although initial access is read-only, attackers can exploit Unix sockets to launch new, privileged containers, achieving full host compromise.

Conditions/Preconditions:

• The vulnerability occurs when the NVIDIA Container Toolkit is used with its default configuration.
• A crafted container image is required to exploit vulnerability.

Who is at risk?

• Any AI application running the vulnerable container toolkit, whether in the cloud or on-premises, is affected.
• Cloud Service Providers are particularly vulnerable.

Attack Vector:

• The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) issue.
• It involves manipulating file paths during mount operations using a symbolic link. This allows mounting from outside the container (the root directory) into a path within "/usr/lib64".
• Even though the initial access to the host file system is read-only, attackers can interact with Unix sockets to spawn new privileged containers and gain unrestricted access.

Affected Versions:

• NVIDIA Container Toolkit: All versions up to and including 1.17.3
• NVIDIA GPU Operator: All versions up to and including 24.9.1

Recommendations:

• Update to the latest version of NVIDIA Container Toolkit (1.17.4) and NVIDIA GPU Operator (24.9.2).
• Do not disable the --no-cntlibs flag in production environments.
• Prioritize patching for VMs that are likely using the toolkit to launch container images.
• Prioritize cases where vulnerable container hosts are using a container image from a publicly writable repository or an external source.

XYZCorp's Solution:

At XYZCorp, we understand the importance of security in your AI pipelines. That's why our vulnerability-free, signed images provide a trusted and verified source for your most critical workload.

Stay safe!