NVIDIA Container Toolkit TOCTOU Container Escape
- Product
- NVIDIA NVIDIA Container Toolkit
- CVE
- CVE-2024-0132
- Disclosed
- 2024-09-26
- CVSS
- 9
- Auth
- requires auth / interaction
- CISA KEV
- no
- Affected
- Container Toolkit <= 1.16.1; GPU Operator <= 24.6.1 (non-CDI mode)
- Fixed
- Container Toolkit 1.16.2; GPU Operator 24.6.2
Summary
A crafted container image could escape to the host on any machine using NVIDIA's container toolkit for GPU access, including shared cloud AI platforms. Wiz estimated it affected over a third of cloud environments.
Root cause
A time-of-check/time-of-use race in how the toolkit mounted host libraries into the container allowed a malicious image to swap paths with symlinks, causing the host root filesystem to be mounted into the container. From there the attacker can reach the container runtime socket and run privileged containers.
Impact
Full host compromise from a malicious container image, breaking multi-tenant GPU isolation.
Detection
Inventory nvidia-container-toolkit versions (nvidia-ctk --version) and GPU Operator releases; flag <= 1.16.1 not using CDI.
Mitigation
Upgrade to 1.16.2+/GPU Operator 24.6.2+ and only run trusted images on GPU hosts.