CVE-2025-23267: Symlink Attack in the NVIDIA Container Toolkit's ldcache Hook
| CVE | Score | Affected | Patched | Disclosed |
|---|---|---|---|---|
| CVE-2025-23267 | 8.5 High | Container Toolkit ≤ v1.17.7 / GPU Operator ≤ 25.3.0 | Toolkit v1.17.8 / Operator 25.3.1 | July 15, 2025 |
Discovered by Lei Wang and Min Yao (Nebula Security Lab, Huawei Cloud).
For executives
The same July 2025 security bulletin that disclosed NVIDIAScape (CVE-2025-23266) contained a second distinct vulnerability in the NVIDIA Container Toolkit. Where NVIDIAScape allows an attacker to execute code as root on the host, CVE-2025-23267 allows a malicious container image to reach outside its boundary and tamper with files on the underlying server. Successful exploitation can corrupt shared library configurations, disrupt running AI workloads, and degrade or destroy the infrastructure other tenants depend on.
The flaw
The update-ldcache hook follows symbolic links without adequately verifying that those links resolve within the container's filesystem boundary. An attacker who crafts a container image with symlinks pointing to locations on the host filesystem can cause the hook to follow those links during the ldcache update process.
This is a link-following vulnerability, classified under CWE-59 (Improper Link Resolution Before File Access). It does not require a kernel exploit. It does not require elevated privileges within the container. It requires a crafted image.
What an attacker can achieve
Corrupting the host ldcache affects every process that loads shared libraries dynamically. Any subsequent container start on that node may fail, the GPU driver libraries may become inaccessible, and running AI workloads may terminate unexpectedly. The effect is a targeted denial of service against the node's entire container runtime.
Patch and mitigation
Upgrade the NVIDIA Container Toolkit to v1.17.8 or later. Upgrade the GPU Operator to 25.3.1 or later. Unlike CVE-2025-23266, CVE-2025-23267 does affect systems where crun is used as the low-level container runtime.