NVIDIA Container Toolkit Hook LD_PRELOAD Escape (NVIDIAScape)
- Product
- NVIDIA NVIDIA Container Toolkit
- CVE
- CVE-2025-23266
- Disclosed
- 2025-07-17
- CVSS
- 9
- Auth
- requires auth / interaction
- CISA KEV
- no
- Affected
- Container Toolkit <= 1.17.7; GPU Operator <= 25.3.0
- Fixed
- Container Toolkit 1.17.8; GPU Operator 25.3.1
Summary
Wiz showed that a three-line Dockerfile could break out of a GPU container and get root on the host. The flaw lives in an OCI hook the toolkit runs while setting up the container.
Root cause
The createContainer hook (nvidia-ctk) ran with host privileges but inherited environment variables from the container image. Setting LD_PRELOAD in the image made the privileged hook load an attacker-supplied shared library from the container's filesystem (via /proc/self/cwd), executing it as root on the host.
Impact
Container escape to root on the host, compromising other tenants' models and data on shared GPU infrastructure.
Public PoC
FROM busybox
ENV LD_PRELOAD=/proc/self/cwd/poc.so
ADD poc.so /Source: Wiz Research - NVIDIAScape
Detection
Check toolkit/GPU Operator versions; scan images for ENV LD_PRELOAD entries.
Mitigation
Upgrade to 1.17.8 / 25.3.1, or disable the enable-cuda-compat hook as a workaround.