When Containers Break the Rules: CVE-2025-23267 in NVIDIA Container Toolkit and the Perils of Link Following

Introduction

Picture an AI training job on a multi-million-dollar GPU cluster, sabotaged because a single container image let an attacker overwrite critical files on the host. CVE-2025-23267, a high-severity vulnerability in NVIDIA's Container Toolkit, makes that possible. It has a CVSS score of 8.5 and affects all Toolkit versions up to 1.17.7. An attacker can use it to break container boundaries and tamper with host files, which may lead to data loss, denial of service, or even container escape.

About NVIDIA and the Container Toolkit: NVIDIA leads the GPU computing market. Its hardware runs AI research, autonomous vehicles, cloud gaming, and scientific simulations. The NVIDIA Container Toolkit is what enterprises, cloud providers, and research institutions worldwide use to run GPU-accelerated workloads in containers.

---

Technical Information

Vulnerability Mechanism

CVE-2025-23267 is a classic link-following bug, classified as CWE-59: Improper Link Resolution Before File Access. It sits in the Toolkit's update-ldcache hook, which updates the dynamic linker cache (ld.so.cache) inside a container so that GPU libraries can be found at runtime.

The hook runs the host's ldconfig binary with the -r (chroot) option and points it at the container's root filesystem. It does not properly sandbox that call or validate the symbolic links inside the container image. If an attacker builds an image with symbolic links that point outside the container's intended root (for example, to /etc/ld.so.cache or other sensitive host files), ldconfig may follow those links and overwrite or tamper with files on the host.

Exploitation Flow

1. The attacker builds a malicious container image with symbolic links that target sensitive host files, such as /etc/ld.so.cache.
2. The image is deployed and run in an environment that uses a vulnerable version of the NVIDIA Container Toolkit.
3. During container initialization, the update-ldcache hook runs ldconfig with the container's root as the chroot target.
4. ldconfig follows the malicious symbolic links and writes to the host's files instead of the container's.
5. The result is tampering with host files, potential denial of service, and possible container escape if the attacker can subvert the host's dynamic linker configuration.

Technical Root Cause

The hook does not validate symbolic links, and the ldconfig call runs with too little sandboxing around it. The Toolkit assumes the container's root filesystem is isolated. Malicious links can break that isolation, especially when hooks run with elevated privileges or in environments with shared mounts.

Attack Vectors

• Multi-tenant Kubernetes clusters, where a malicious user can submit an image to a shared GPU cluster and target host files.
• CI/CD pipelines, where automated build systems that run untrusted images risk compromising the host.
• Public cloud GPU offerings on vulnerable Toolkit versions, which are at risk of cross-tenant attacks.

Affected Code Pattern

The exact code is not published, but the vulnerable pattern looks like this:

// Pseudocode illustrating the issue
func updateLdCache(rootfs string) error {
    // No validation of symlinks in rootfs
    cmd := exec.Command("ldconfig", "-r", rootfs)
    return cmd.Run()
}

---

Patch Information

NVIDIA has released updates for critical vulnerabilities in its Container Toolkit and GPU Operator software. Users are strongly advised to upgrade to the latest versions.

Updated Versions:

• NVIDIA Container Toolkit: Upgrade to version 1.17.8.
• NVIDIA GPU Operator: Upgrade to version 25.3.1.

Mitigation Steps:

If you cannot upgrade right away, NVIDIA offers a temporary mitigation, which is to disable the vulnerable enable-cuda-compat hook.

For NVIDIA Container Runtime in Legacy Mode:

Add the following to the /etc/nvidia-container-toolkit/config.toml file:

[features]
disable-cuda-compat-lib-hook = true

For NVIDIA GPU Operator:

When you deploy with Helm, add these arguments:

--set "toolkit.env[0].name=NVIDIA_CONTAINER_TOOLKIT_OPT_IN_FEATURES" \
--set "toolkit.env[0].value=disable-cuda-compat-lib-hook"

On GPU Operator versions before 25.3.1, deploy NVIDIA Container Toolkit 1.17.8 by adding:

--set "toolkit.version=v1.17.8-ubuntu20.04"

Note: For Red Hat Enterprise Linux or Red Hat OpenShift, use the v1.17.8-ubi8 tag.

Patch Sources:

• NVIDIA Security Advisory
• CyberPress Vulnerability Analysis

---

Affected Systems and Versions

• NVIDIA Container Toolkit: All versions up to and including 1.17.7 are vulnerable.
  • In CDI mode, only versions before 1.17.5 are affected.
• NVIDIA GPU Operator: All versions before 25.3.1 are affected if they use a vulnerable Container Toolkit version.
• Vulnerable configurations:
  • Default installations (legacy and GPU Operator modes)
  • Systems where the update-ldcache hook is enabled (the default in most deployments)

---

Vendor Security History

NVIDIA generally responds well to security issues, with fast patch releases and detailed advisories. Still, 2025 has brought two major container-related vulnerabilities, CVE-2025-23266 and CVE-2025-23267, which shows how complex and risky GPU virtualization stacks are. For this one, NVIDIA released a patch (v1.17.8) and an advisory within a week of disclosure, a mature and responsive turnaround. The company credits external researchers Lei Wang and Min Yao (Nebula Security Lab, Huawei Cloud) for responsible disclosure.

---

References

• NVIDIA Security Advisory
• CyberPress Vulnerability Analysis
• GBHackers Technical Writeup
• SecurityOnline Info
• The CyberThrone Coverage
• NVIDIA Container Toolkit Release Notes
• CWE-59 Link Following Background
• Feedly CVE Tracker
• Openwall oss-security Disclosure
• NVD Entry for CVE-2025-23267

Source: This report was created using AI

If you have suggestions for improvement or feedback, please email us at [email protected]