The February 2025 Container Toolkit Bulletin: Why NVIDIA Held the Details for Five Months
| Bulletin | CVEs Covered | Disclosed |
|---|---|---|
| NVIDIA Container Toolkit — February 2025 | CVE-2024-0132 (full technical disclosure) / CVE-2025-23359 (bypass) | February 11, 2025 |
Research by Wiz Research (Ofir Cohen, Shay Berkovich, Avigayil Mechtinger, Andres Riancho, Ronen Shustin, Shir Tamari).
For executives
When NVIDIA disclosed a critical container escape vulnerability in September 2024, the security researchers who found it published almost no technical details. That was deliberate. During the disclosure process, NVIDIA's security team discovered that its own patch did not fully fix the problem. It asked the researchers to hold back while a more complete solution was developed. Five months later, the full technical details were released — alongside the disclosure of a bypass that had been confirmed and patched in the interim.
What the full technical disclosure revealed
The vulnerability in CVE-2024-0132 lives in the NVIDIA Container Toolkit's mount_files function. The TOCTOU race condition: the toolkit checks a path at one moment. An attacker replaces a legitimate path with a symlink between that check and the subsequent mount operation. The toolkit then mounts whatever the symlink points to — directed at a host filesystem location.
Public proof-of-concept exploits for CVE-2024-0132 existed on GitHub within weeks of the full February disclosure.
What this sequence reveals about disclosure
The extended embargo was the right call. Publishing full technical details of a container escape in a component installed on every GPU in the world, while a bypass remained unpatched, would have caused real harm. The five-month timeline reflects the genuine complexity of finding, confirming, and patching a bypass in critical infrastructure.