Skip to main content

CVE-2024-0132 + CVE-2024-0133: The Container Escape That Changed How the Industry Thinks About GPU Security

CVEScoreComponentPatchedDisclosed
CVE-2024-01329.0 CriticalNVIDIA Container Toolkit ≤ v1.16.1v1.16.2 / GPU Operator v24.6.2September 26, 2024
CVE-2024-0133MediumNVIDIA Container Toolkit ≤ v1.16.1v1.16.2 / GPU Operator v24.6.2September 26, 2024

Discovered by Andres Riancho, Ronen Shustin, and Shir Tamari (Wiz Research).

For executives​

In September 2024, Wiz Research disclosed a critical vulnerability in the NVIDIA Container Toolkit that allowed a container running on a GPU host to escape its isolation boundary and access the underlying server. Every GPU container in production depends on the NVIDIA Container Toolkit. The scope was effectively universal. What made this disclosure unusual was how little technical detail was published alongside it — the researchers deliberately withheld the mechanism because NVIDIA's own patch did not fully fix the problem.

The vulnerability​

The vulnerability class is TOCTOU — Time-of-Check Time-of-Use. The Container Toolkit checks that file paths being mounted from a container image are safe, then mounts them. The race condition lives in the window between that check and the mount: an attacker can replace a legitimate path with a symlink that redirects the mount to a host filesystem location.

CVE-2024-0133: the companion flaw​

Where CVE-2024-0132 allows full host filesystem access via mount redirection, CVE-2024-0133 allows a crafted container image to create empty files on the host filesystem. Creating files at specific paths can affect the behaviour of host processes that check for file existence as part of their control flow.

Who was affected​

Every deployment of the NVIDIA Container Toolkit at version 1.16.1 or earlier. CDI (Container Device Interface) deployments were not affected. The majority of production GPU container deployments in 2024 used the standard NVIDIA Container Runtime rather than CDI.

Patch​

Upgrade Container Toolkit to v1.16.2 or later. Upgrade GPU Operator to v24.6.2 or later. For full remediation of the bypass CVE-2025-23359, upgrade to v1.17.4 or later.