Wiz Details NVIDIA Container Toolkit Flaw Enabling Host Escape
Summary
Wiz Research details CVE-2024-0132, a TOCTOU flaw in NVIDIA Container Toolkit that can let a container-image controller mount the host filesystem and escape isolation. NVIDIA says version 1.17.4 fixes it and a patch bypass, CVE-2025-23359.
Key points
- Wiz Research says CVE-2024-0132 lets an attacker controlling an image run by the vulnerable toolkit manipulate filesystem paths during mounting to expose the host filesystem inside a container.
- In the researchers’ exploit, access to the host’s docker.sock enables launching a privileged container and gaining full host access.
- The article says the issue affects Docker, Containerd and CRI-O; Wiz also confirmed an impact on gVisor, though the same socket-based privilege escalation may require adjustments on some Linux distributions.
- Wiz reports finding vulnerable cloud service providers and says some cases could allow full compromise of a Kubernetes cluster shared across multiple tenants.
- The article says environments using the Container Device Interface avoid the affected code; it gives Podman’s native CDI support as an example.
- NVIDIA Container Toolkit 1.17.4 addresses CVE-2024-0132 and the patch bypass tracked as CVE-2025-23359. Wiz also advises against disabling --no-cntlibs in production.
Article Details
- Attack Vectors
- An attacker controlling a container image can exploit a time-of-check/time-of-use flaw in NVIDIA Container Toolkit path handling by changing filesystem entries between mount operations, causing host filesystem content to be mounted into the container.
- The described exploit replaces a container path with a symbolic link that resolves to the host filesystem root, escaping container isolation.
- After gaining access to the host's docker.sock, the attacker can launch a privileged container to obtain full host access.
- The article reports that the vulnerability also affects gVisor environments, although the docker.sock privilege-escalation step may require adjustments on some Linux distributions.
- Defensive Notes
- Update NVIDIA Container Toolkit to version 1.17.4, which the article says addresses both vulnerabilities.
- Do not disable the --no-cntlibs flag in production environments.
- Prioritize vulnerable container hosts running images from publicly writable repositories or external sources.
- The article says environments using the Container Device Interface (CDI), including Podman configurations using native CDI support, do not use the affected code path.
MITRE ATT&CK
T1609 · Container Administration CommandAfter accessing the host's docker.sock, the exploit launches a privileged container to gain full host access.T1611 · Escape to HostThe exploit mounts the host filesystem into the container through manipulated paths and symbolic links, breaking container isolation.
CVE
CVE-2024-0132In September of last year, Wiz Research uncovered a critical security vulnerability, tracked as CVE-2024-0132, in the widely used NVIDIA Container Toolkit, which provides containerized AI applications with access to GPUCVE-2025-23359of both the original vulnerability and the bypass. The bypass is tracked under a separate CVE, CVE-2025-23359. We strongly encourage everyone to update to the latest version of the NVIDIA Container Toolkit,
People
Andres RianchoNamed member of the Wiz Research team that uncovered and analyzed the vulnerability.Hillai Ben-SassonNamed member of the Wiz Research team that uncovered and analyzed the vulnerability.Nir OhfeldNamed member of the Wiz Research team that uncovered and analyzed the vulnerability.Ronen ShustinNamed member of the Wiz Research team that uncovered and analyzed the vulnerability.Sagi TzadikNamed member of the Wiz Research team that uncovered and analyzed the vulnerability.Shir TamariNamed member of the Wiz Research team that uncovered and analyzed the vulnerability.
Vendors
Products
ContainerdDocker then communicates with containerd, which manages the container lifecycle, handles image transfers, and sets up networking.CRI-OThe NVIDIA Container Toolkit supports multiple container runtimes such as Docker, Containerd (Kubernetes), CRI-O, and Podman. This blog post will focus on Docker but other including Containerd and CRI-O are affected byDockerwe exploit this by mounting the host’s filesystem within the container and then leveraging access to docker.sock to launch a privileged container and fully compromise the host.gVisorthroughout the disclosure process—we truly appreciate their support. We also want to thank the gVisor team for reviewing this blog.KubernetesIn some cases, the vulnerability allowed for the full compromise of a Kubernetes cluster shared across multiple tenants.Nvidia Container Toolkituncovered a critical security vulnerability, tracked as CVE-2024-0132, in the widely used NVIDIA Container Toolkit, which provides containerized AI applications with access to GPU resources. Our initial blog