CVE-2025-23266: 
Rocky Linux vulnerability analysis and mitigation

CVE-2025-23266, dubbed NVIDIAScape, is a critical container escape vulnerability in the NVIDIA Container Toolkit (NCT) affecting all platforms. It was discovered by Wiz Research and reported to NVIDIA on May 17, 2025 via Pwn2Own Berlin; NVIDIA published its security bulletin on July 15, 2025, and the CVE was publicly disclosed on July 17, 2025. The vulnerability affects NVIDIA Container Toolkit all versions up to and including v1.17.7 (CDI mode only for versions prior to v1.17.5) and NVIDIA GPU Operator all versions up to and including 25.3.0. It carries a CVSS v3.1 base score of 9.0 (Critical) (Wiz Blog, NVIDIA Advisory).

The root cause is classified as CWE-426 (Untrusted Search Path), mapped to MITRE ATT&CK technique T1574.007 (Path Interception by PATH Environment Variable). The vulnerability exists in the OCI createContainer hook (enable-cuda-compat) used by the NVIDIA Container Toolkit to initialize GPU access for containers. Unlike prestart hooks, createContainer hooks inherit environment variables from the container image without sanitization. An attacker can set LD_PRELOAD in a Dockerfile to point to a malicious shared library (.so file) within the container's filesystem; when the privileged nvidia-ctk hook process executes on the host, it loads the attacker-controlled library because the hook's working directory is set to the container's root filesystem, completing the escape. The attack vector is adjacent network (AV:A), requires low privileges (PR:L), and has a changed scope (S:C), reflecting that exploitation crosses the container isolation boundary to the host (Wiz Blog, NVIDIA Advisory).

Successful exploitation allows a low-privileged attacker with adjacent network access to escape the container boundary and achieve full root access on the host machine, impacting confidentiality, integrity, and availability (all rated HIGH). In multi-tenant AI cloud environments — where multiple customers share GPU infrastructure — a malicious container can access, steal, or tamper with sensitive data and proprietary AI models belonging to other tenants on the same host. This represents a systemic risk to the AI ecosystem, as the NVIDIA Container Toolkit underpins GPU-accelerated workloads across all major cloud providers (Wiz Blog).

1. Reconnaissance: Identify target environments running NVIDIA Container Toolkit ≤ v1.17.7 or GPU Operator ≤ 25.3.0 on shared GPU infrastructure (e.g., managed AI cloud services, Kubernetes clusters with GPU nodes).
2. Craft malicious shared library: Create a malicious shared library (poc.so) that executes arbitrary code (e.g., writes attacker-controlled data to the host filesystem, spawns a reverse shell, or reads sensitive host files) when loaded via LD_PRELOAD.
3. Build malicious container image: Create a Dockerfile that sets LD_PRELOAD to the library path and bundles the library:

FROM busybox
ENV LD_PRELOAD=/proc/self/cwd/poc.so
ADD poc.so /

4. Deploy the container: Push the image to a registry accessible by the target and run it on the vulnerable host using the NVIDIA runtime:

docker build . -t nct-exploit
docker run --rm --runtime=nvidia --gpus=all nct-exploit

5. Trigger hook execution: When the container starts, the NVIDIA Container Toolkit's createContainer hook (nvidia-ctk hook enable-cuda-compat) executes as a privileged host process, inheriting the LD_PRELOAD environment variable from the container image.
6. Achieve host root access: The privileged nvidia-ctk process loads poc.so from the container's root filesystem (its working directory), executing the attacker's payload with root privileges on the host — completing the container escape (Wiz Blog).

• Process: Unexpected child processes spawned by nvidia-ctk with elevated privileges (e.g., bash, sh, curl, wget, python); nvidia-ctk hook enable-cuda-compat process loading non-standard shared libraries.
• File System: Unexpected files written to host directories (e.g., /owned, /tmp/, /root/) by the nvidia-ctk process; presence of .so files in container image layers that are not part of standard NVIDIA toolkit packages.
• Logs: Container runtime logs showing nvidia-ctk hook execution followed by anomalous system calls; audit logs (auditd) recording LD_PRELOAD usage by privileged processes; unexpected open() or mmap() syscalls on .so files from container filesystem paths (e.g., /proc/self/cwd/).
• Network: Outbound connections from the host to unknown external IPs initiated by processes with nvidia-ctk as a parent; reverse shell connections originating from GPU worker nodes.
• Environment: Presence of LD_PRELOAD set to paths within /proc/self/cwd/ or container root filesystem paths in the environment of privileged host processes (Wiz Blog).

Patch: Upgrade NVIDIA Container Toolkit to v1.17.8 or later and NVIDIA GPU Operator to v25.3.1 or later (NVIDIA Advisory).

Workaround (NVIDIA Container Runtime): Disable the vulnerable hook by editing /etc/nvidia-container-toolkit/config.toml:

[features]
disable-cuda-compat-lib-hook = true

Workaround (GPU Operator via Helm):

--set "toolkit.env[0].name=NVIDIA_CONTAINER_TOOLKIT_OPT_IN_FEATURES" \
--set "toolkit.env[0].value=disable-cuda-compat-lib-hook"

For GPU Operator versions prior to 25.3.1, deploy the patched toolkit directly: --set "toolkit.version=v1.17.8-ubuntu20.04" (use v1.17.8-ubi8 for RHEL/OpenShift). Additionally, restrict which container images can be run on GPU hosts to trusted, verified sources, and implement strong workload isolation (e.g., VM-level isolation) for multi-tenant environments (Wiz Blog, NVIDIA Advisory).

Wiz Research, who discovered and disclosed the vulnerability, published a detailed technical blog post dubbing it #NVIDIAScape and emphasized its systemic risk to the AI ecosystem, noting it is the second major container escape they have found in the NVIDIA Container Toolkit (following CVE-2024-0132) (Wiz Blog). The vulnerability received significant media coverage from The Hacker News, GBHackers, CyberSecurityNews, SecurityOnline, and TechRepublic, with many outlets highlighting the alarming simplicity of the three-line exploit. The security community on Mastodon, Bluesky, and Reddit (r/blueteamsec, r/kubernetes) actively discussed the vulnerability, with researchers noting the broader implications for AI cloud security. Upwind.io published a contextual analysis noting that most AI workloads may be safe depending on deployment configuration, providing nuance to the severity framing. The Zero Day Initiative assigned advisory ZDI-25-626 to the vulnerability.