| CVE | Score | Affected | Patched | Disclosed |
|---|---|---|---|---|
| CVE-2025-23359 | 8.3 High | Container Toolkit ≤ v1.17.3 / GPU Operator ≤ 24.9.1 | Toolkit v1.17.4 / Operator 24.9.2 | February 11, 2025 |
Discovered by Ofir Cohen, Shay Berkovich, and Avigayil Mechtinger (Wiz Research).
For executives
In September 2024, NVIDIA patched a critical flaw in the Container Toolkit that allowed attackers to escape container isolation and access the host server. Five months later, researchers demonstrated the patch was incomplete. CVE-2025-23359 is a bypass of that fix — a different route to the same outcome. An attacker who gets a GPU container scheduled can read the host filesystem and, from there, issue commands that achieve full host control.
The bypass mechanism
The NVIDIA Container Toolkit's mount_files function processes paths from the container image before mounting them. CVE-2025-23359 routes around the original patch's validation using the /usr/local/cuda/compat/ mount path. The toolkit processes this path twice during initialization. The patch validated the path at first resolution. At second use, a crafted symlink in that path can redirect the mount to an arbitrary host filesystem location.
From read-only to full control
Initial access from a successful exploit is read-only access to the host filesystem. With read-only access, an attacker can read the path to the Docker daemon's Unix socket. Security researchers have demonstrated the transition from read-only host filesystem access to launching new privileged containers as a single-step operation using Docker socket manipulation.
The DoS companion
Trend Micro researcher Abdelrahman Esmail identified a related performance flaw: when multiple containers are created with mounts using bind-propagation=shared, the Linux mount table grows without bound, exhausting file descriptors until Docker cannot create new containers on the host.
Patch and mitigation
Upgrade the Container Toolkit to v1.17.4 or later. Upgrade the GPU Operator to 24.9.2 or later. Caution: v1.17.4 introduced a feature flag, allow-cuda-compat-libs-from-container. Enabling this flag re-exposes the TOCTOU vulnerability. Leave it disabled.