Apr 12, 2025, 06:39 PM
? NVIDIA Container Toolkit Still Vulnerable: Incomplete Patch Leaves Systems at Risk
? April 10, 2025
✍️ Ravie Lakshmanan | ? Container Security / Vulnerabilities
Cybersecurity researchers have uncovered a critical oversight in a previously patched vulnerability in the NVIDIA Container Toolkit, reigniting concerns over container security and system integrity.
The original flaw, CVE-2024-0132 (CVSS score: 9.0), is a high-severity Time-of-Check to Time-of-Use (TOCTOU) vulnerability. If successfully exploited, it could allow attackers to break out of containers and gain unauthorized access to the host system—a worst-case scenario for environments relying on container isolation.
? Patch or Patchy?
Although NVIDIA released a fix back in September 2024, a fresh analysis by Trend Micro reveals that the patch was incomplete. Even more concerning: a new performance-related issue tied to Docker on Linux was discovered during the investigation.
“These issues could enable attackers to escape container isolation, access sensitive host resources, and cause severe operational disruptions,” said Abdelrahman Esmail, a researcher at Trend Micro.
The vulnerability continues to exist in version 1.17.4 of the toolkit when the feature
allow-cuda-compat-libs-from-container
is enabled. The root cause? A lack of proper locking in the
mount_files
function, which can allow a container to escalate privileges and execute arbitrary code on the host.
? New CVE Assigned: CVE-2025-23359
This follow-up issue has been officially recognized as CVE-2025-23359 (CVSS 9.0) and was previously flagged by cloud security firm Wiz as a bypass of the original vulnerability. While a new fix has been issued in version 1.17.4, questions remain about how such a critical gap was missed in the first place.
? Hidden Danger: Performance Pitfalls and DoS Risk
During its analysis, Trend Micro also discovered a performance flaw that can result in a denial-of-service (DoS) attack. It affects Docker containers running on Linux, especially when multiple shared mounts are involved.
“When containers with
bind-propagation=shared
are created, a complex web of parent/child paths is generated,” Esmail explained. “But once those containers are terminated, the mount table entries are not cleaned up. This leads to mount table bloat, quickly exhausting file descriptors (fd) and eventually crashing Docker.”
In severe cases, even SSH access to the host can be blocked due to the system becoming unresponsive.
?️ Recommended Mitigations
To reduce the risk:
- Monitor the Linux mount table for abnormal growth
[*]- Restrict Docker API access to trusted users only
[*]- Enforce strong access controls
[*]- Regularly audit container-to-host filesystem bindings, volume mounts, and sockets
? April 10, 2025
✍️ Ravie Lakshmanan | ? Container Security / Vulnerabilities
Cybersecurity researchers have uncovered a critical oversight in a previously patched vulnerability in the NVIDIA Container Toolkit, reigniting concerns over container security and system integrity.
The original flaw, CVE-2024-0132 (CVSS score: 9.0), is a high-severity Time-of-Check to Time-of-Use (TOCTOU) vulnerability. If successfully exploited, it could allow attackers to break out of containers and gain unauthorized access to the host system—a worst-case scenario for environments relying on container isolation.
? Patch or Patchy?
Although NVIDIA released a fix back in September 2024, a fresh analysis by Trend Micro reveals that the patch was incomplete. Even more concerning: a new performance-related issue tied to Docker on Linux was discovered during the investigation.
“These issues could enable attackers to escape container isolation, access sensitive host resources, and cause severe operational disruptions,” said Abdelrahman Esmail, a researcher at Trend Micro.
The vulnerability continues to exist in version 1.17.4 of the toolkit when the feature
allow-cuda-compat-libs-from-container
is enabled. The root cause? A lack of proper locking in the
mount_files
function, which can allow a container to escalate privileges and execute arbitrary code on the host.
? New CVE Assigned: CVE-2025-23359
This follow-up issue has been officially recognized as CVE-2025-23359 (CVSS 9.0) and was previously flagged by cloud security firm Wiz as a bypass of the original vulnerability. While a new fix has been issued in version 1.17.4, questions remain about how such a critical gap was missed in the first place.
? Hidden Danger: Performance Pitfalls and DoS Risk
During its analysis, Trend Micro also discovered a performance flaw that can result in a denial-of-service (DoS) attack. It affects Docker containers running on Linux, especially when multiple shared mounts are involved.
“When containers with
bind-propagation=shared
are created, a complex web of parent/child paths is generated,” Esmail explained. “But once those containers are terminated, the mount table entries are not cleaned up. This leads to mount table bloat, quickly exhausting file descriptors (fd) and eventually crashing Docker.”
In severe cases, even SSH access to the host can be blocked due to the system becoming unresponsive.
?️ Recommended Mitigations
To reduce the risk:
- Monitor the Linux mount table for abnormal growth
[*]- Restrict Docker API access to trusted users only
[*]- Enforce strong access controls
[*]- Regularly audit container-to-host filesystem bindings, volume mounts, and sockets