Multi-Tenant GPU Risk in Neocloud and Hyperscaler Environments: Where Known CVEs Land Hardest
For executives
Every vulnerability in this library was found and patched in a lab environment. In production, those vulnerabilities live in specific deployment configurations. The configuration that amplifies their impact most dramatically is multi-tenancy: multiple customers' workloads running on shared physical GPU hardware. The blast radius of a container escape, a vGPU Manager vulnerability, or a MIG isolation violation in a multi-tenant environment extends from the attacker to every co-located customer.
The multi-tenancy threat model
In a single-tenant GPU environment, a compromised container gives an attacker access to that container's workload and, via driver vulnerabilities, potentially the host. The blast radius is bounded by what runs on that host.
In a multi-tenant GPU environment, the blast radius includes workloads from multiple customers. A successful container escape on a neocloud GPU node gives an attacker: access to every other customer's containers running on that node, potential access to every other customer's GPU memory via residual VRAM, and the ability to read any other customer's model weights, inference inputs, and user data currently in GPU memory.
The SemiAnalysis ClusterMAX analysis of neocloud security explicitly flagged CVE-2024-0132 as a live multi-tenant risk in neocloud infrastructure.
How neoclouds typically deploy GPU workloads
The standard neocloud architecture runs customer workloads as containers on bare-metal GPU nodes. Kubernetes manages scheduling. The NVIDIA Container Toolkit is installed on every node. This is the precise configuration that the Container Toolkit vulnerability series targets.
Hyperscaler shared responsibility and the GPU layer
AWS, Azure, and GCP offer managed GPU instances and GPU container services. The hypervisor security and physical isolation are in the cloud provider's scope. But the NVIDIA Container Toolkit, which runs within customer-managed container environments, is typically in the customer's scope.
This means that CVE-2024-0132, CVE-2025-23266, and the Container Toolkit series are customer-responsibility vulnerabilities in hyperscaler GPU environments. If a customer has not patched their Container Toolkit, the vulnerability exists in their managed GPU instance regardless of the hyperscaler's security posture.