CVE-2024-0135 / CVE-2024-0136 / CVE-2024-0137: How Unprivileged Containers Bypassed the Kubernetes GPU Scheduler
| CVE | Score | Affected | Patched | Disclosed |
|---|---|---|---|---|
| CVE-2024-0135 | 7.6 High | Container Toolkit all versions / GPU Operator all versions | Toolkit v1.17.3 | January 13, 2025 |
| CVE-2024-0136 | Conditional | Non-default ldconfig config only | Same | January 13, 2025 |
| CVE-2024-0137 | Conditional | Non-default ldconfig config only | Same | January 13, 2025 |
Discovered by Andres Riancho, Ronen Shustin, and Shir Tamari (Wiz Research).
For executives
Kubernetes controls which containers get access to GPUs using a scheduling system that enforces resource requests and limits. The January 2025 NVIDIA Container Toolkit security bulletin revealed that this assumption was wrong. Default GPU Operator installations allowed any container that set a single environment variable to bypass the Kubernetes GPU scheduler entirely, accessing GPU hardware it was never allocated — including GPUs assigned to other workloads on the same node.
The Device Plugin bypass
The NVIDIA Container Toolkit reads the NVIDIA_VISIBLE_DEVICES environment variable from container specifications. In the default GPU Operator installation, the Container Toolkit honoured this environment variable even for unprivileged containers — even when the Kubernetes device plugin had not allocated any GPU to that container.
The result: any container that included NVIDIA_VISIBLE_DEVICES=all could access every GPU on the node, regardless of what the scheduler had allocated. In Kubernetes clusters running the default GPU Operator configuration, the entire device plugin allocation enforcement was effectively advisory.
CVE-2024-0136 and CVE-2024-0137
These are conditional — they only affect environments where the ldconfig binary path is set to run from the container's filesystem rather than the host's. CVE-2024-0136 gives an attacker read and write access to host devices. CVE-2024-0137 allows untrusted code to run in the host's network namespace.
Patch and mitigation
Upgrade the Container Toolkit to v1.17.3 or later. After upgrading, verify the ldconfig configuration in /etc/nvidia-container-runtime/config.toml reads ldconfig = "@/sbin/ldconfig" with the @ prefix present.