HEXACON Researchers Demonstrate NVIDIA GPU Driver Exploit Escaping Azure Containers
· 40:36 · Watch on YouTube ↗
Summary
At HEXACON 2025, IBM X Force researchers demonstrated an NVIDIA GPU driver exploit that escaped a container on Azure serverless GPU compute and obtained a root shell on the host, exposing risks from shared-kernel isolation.
Key points
- The demonstration began with code running inside an Azure training-job container and obtained a root shell on the host compute node; the researchers showed visibility into other users' colocated training jobs.
- The vulnerability involves concurrent GPU-attachment ioctl operations, producing a double-free primitive for attacker-sized allocations.
- The exploit used large allocations and the physical page allocator to avoid slab double-free defenses, then manipulated pipe buffers to obtain arbitrary kernel memory reads and writes.
- Flushing per-CPU free lists and using hardware timers improved race control; the researchers reported extending the race window from about 20 microseconds to nearly 38 milliseconds.
- The speakers warned that GPU driver access remains reachable from GPU-enabled containers, making shared-kernel isolation a cross-tenant security risk.
- The researchers also described working around mitigation v4 protections through page-level exploitation. They did not provide affected driver versions or patch status in the transcript.
Article Details
- Topics
- [01:39] CUDA and the NVIDIA containerized GPU technology stack
- [04:00] GPU driver access as a kernel-level container escape path
- [07:05] Driver fuzzing setup, statefulness, and coverage limitations
- [12:14] Shared-kernel isolation and cross-tenant risks in GPU clouds
- [15:38] Azure serverless GPU container escape demonstration
- [17:23] GPU-attachment race condition and double-free exploitation
- [27:22] Physical page allocation and techniques for improving race reliability
- [31:36] Pipe-buffer exploitation, arbitrary kernel memory access, and mitigation v4
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe demonstrated GPU driver double-free exploit established arbitrary kernel memory access and used it for local privilege escalation.T1611 · Escape to HostThe researchers demonstrated escaping an Azure GPU workload container by exploiting the NVIDIA GPU driver and modifying process privilege and sandboxing information to obtain host-level root access.
People
Samuel LovejoyCo-presenter of CUDA de Grâce; explained the GPU driver race condition, double-free exploitation, reliability improvements, and kernel mitigation workarounds.Valentina PalmiottiCo-presenter of CUDA de Grâce; described the IBM X Force GPU driver research, its cloud threat model, and the Azure container-escape demonstration.