Full Report
Technical details on a critical severity vulnerability (CVE-2024-0132) in NVIDIA Container Toolkit and GPU Operator, affecting cloud service providers .
Analysis Summary
# Vulnerability: Container Escape in NVIDIA Container Toolkit Leading to Host Compromise
## CVE Details
- CVE ID: CVE-2024-0132 (Original vulnerability) and CVE-2025-23359 (Bypass/Follow-up issue)
- CVSS Score: Critical (Severity inferred from "critical security vulnerability" and impact)
- CWE: Not explicitly listed, but indicates improper access control allowing path traversal/filesystem access.
## Affected Systems
- Products: NVIDIA Container Toolkit
- Versions: Versions prior to 1.17.4
- Configurations: Any AI application running the vulnerable container toolkit, including those in cloud or on-premises environments utilizing containers/Docker/gVisor.
## Vulnerability Description
The vulnerability exists within the NVIDIA Container Toolkit and allows an attacker who controls a container image executed by the toolkit to escape the container isolation. This escape enables the attacker to mount the host’s root filesystem into the compromised container, gaining unrestricted read/write access to all host files. Furthermore, by accessing the host's container runtime Unix sockets (like `docker.sock`), the attacker can launch privileged containers, leading to full compromise of the host system. This issue impacted multiple Cloud Service Providers where the toolkit was used, potentially compromising shared Kubernetes clusters across tenants.
## Exploitation
- Status: PoC available (A demonstration was created involving mounting the filesystem and leveraging `docker.sock`).
- Complexity: The description suggests successful exploitation leads to full host compromise, implying medium to high complexity depending on the specific environment prerequisites, but the core technique seems feasible for a container image owner.
- Attack Vector: Network (through a malicious container image execution) leading to Local/Container Escape.
## Impact
- Confidentiality: High (Full access to all host files).
- Integrity: High (Ability to launch privileged containers and modify host configuration).
- Availability: High (Full host compromise possible).
## Remediation
### Patches
- Update to NVIDIA Container Toolkit version **1.17.4** or later, as this version addresses both CVE-2024-0132 and the subsequent bypass (CVE-2025-23359).
### Workarounds
- Do not disable the `--no-cntlibs` flag in production environments.
## Detection
- **Indicators of Compromise (IoCs):** Look for unauthorized mounting of the host's root filesystem (`/`) into a container context, or suspicious activity involving host container runtime sockets (e.g., operations on `/var/run/docker.sock` originating from within a container).
- **Detection Methods and Tools:** Wiz customers can use specified queries within their platform to find vulnerable instances, prioritizing hosts running on NVIDIA GPUs and those using container images from publicly writable repositories.
## References
- Vendor Advisory (Referenced via Wiz Research disclosure): Provided by NVIDIA PSIRT team.
- Wiz Blog Disclosure: hxxps://www.wiz.io/blog/wiz-research-critical-nvidia-ai-vulnerability
- Wiz Research on CVE-2024-0132 and bypass: (Covered in the full advisory released jointly by Wiz and NVIDIA)