NVIDIAScape: Breaking Container Isolation with CVE-2025-23266 in NVIDIA Container Toolkit

Introduction

A single misconfigured container can take down an entire AI cluster. CVE-2025-23266, called "NVIDIAScape," is a flaw in NVIDIA's Container Toolkit that lets an attacker escape container isolation and take root on the host. A malicious container running on a vulnerable GPU node can compromise every workload, model, and dataset on that node.

About NVIDIA and its Container Toolkit: NVIDIA makes the GPU hardware and software behind most AI, machine learning, and high-performance computing workloads. Its Container Toolkit is the standard way to enable GPU acceleration in containers, from Docker to Kubernetes, across public clouds and enterprise data centers. Because it runs in research, finance, healthcare, and autonomous systems, a flaw here reaches a lot of deployments.

Technical Information

CVE-2025-23266 (NVIDIAScape) comes from how the NVIDIA Container Toolkit handles Open Container Initiative (OCI) hooks, specifically the createContainer hook. This hook prepares the container environment and runs as a privileged process on the host. The problem is that it inherits environment variables from the container image, which lets an attacker change the hook's behavior from inside an untrusted container.

The attack uses the LD_PRELOAD environment variable, which tells the dynamic linker to load a given shared library before any others. If an attacker sets LD_PRELOAD to a malicious .so file inside their container image and then triggers the vulnerable hook, the hook loads and runs the attacker's code with root privileges on the host. That breaks the isolation boundary containers are supposed to enforce.

Root cause:

• The nvidia-ctk binary, invoked by the createContainer hook with the enable-cuda-compat argument, runs as root on the host.
• It inherits environment variables, such as LD_PRELOAD, from the container image.
• An attacker can place a malicious .so file in the container and set LD_PRELOAD to point to it.
• When the container starts, the hook loads the attacker's shared library and runs arbitrary code as root on the host.

This flaw is dangerous because it needs no special privileges beyond the ability to run a container on a vulnerable system, which is common in shared GPU clusters and cloud environments.

Proof of Concept

The following Dockerfile shows how an attacker could exploit CVE-2025-23266 (NVIDIAScape):

FROM busybox
ENV LD_PRELOAD=/proc/self/cwd/poc.so
ADD poc.so /

• FROM busybox starts from a minimal container image.
• ENV LD_PRELOAD=/proc/self/cwd/poc.so sets the environment variable to load the attacker's shared library.
• ADD poc.so / copies the malicious .so file into the container.

When this container launches on a system with a vulnerable NVIDIA Container Toolkit, the nvidia-ctk hook loads and runs poc.so as root on the host, giving the attacker full control.

Reference: Wiz Research - NVIDIAScape

Patch Information

NVIDIA has released updates for CVE-2025-23266:

• Container Toolkit: Upgrade to version 1.17.8 or later.
• GPU Operator (Linux): Upgrade to version 25.3.1 or later.

Mitigation for legacy container runtime: Edit /etc/nvidia-container-toolkit/config.toml and add:

[features]
disable-cuda-compat-lib-hook = true

Mitigation for GPU Operator with Helm: When deploying or upgrading, include:

--set "toolkit.env[0].name=NVIDIA_CONTAINER_TOOLKIT_OPT_IN_FEATURES" \
--set "toolkit.env[0].value=disable-cuda-compat-lib-hook"

To set the patched Container Toolkit version by hand during GPU Operator upgrades:

--set "toolkit.version=v1.17.8-ubuntu20.04"

Reference: SecurityOnline.info - NVIDIA Plugs Critical Flaws

Detection Methods

Catching NVIDIAScape attempts means watching how containers interact with the host:

• Monitor environment variables: Watch for containers that set LD_PRELOAD to unexpected shared libraries. This is a strong indicator of an exploitation attempt.
• Track shared library loads: Use system call monitoring to detect execution of unauthorized .so files, especially ones that are not in standard images or host libraries.
• Audit environment variables: Inspect running containers for suspicious environment variable settings.
• File integrity monitoring: Check for creation or modification of shared libraries in directories that containers can reach.
• Log analysis: Log process executions and environment variable usage inside containers, and analyze them for patterns that match the exploit.
• Anomaly detection: Use behavioral analytics to flag deviations from normal container operations, such as unexpected library loads or environment variable changes.

Reference: Wiz Research - NVIDIAScape

Affected Systems and Versions

• NVIDIA Container Toolkit: All versions up to and including 1.17.7 are vulnerable.
• NVIDIA GPU Operator (Linux): All versions up to and including 25.3.0 are vulnerable.
• Vulnerable configurations: Any deployment where the enable-cuda-compat hook is active and the above versions are in use. This includes Docker, containerd, and Kubernetes environments that use NVIDIA GPU acceleration.

Vendor Security History

NVIDIA has had several critical container escape vulnerabilities in recent years:

• CVE-2024-0132: A TOCTOU race condition in the Container Toolkit.
• CVE-2025-23359: Unsafe file operations leading to privilege escalation.

The company has responded to disclosures quickly, releasing patches within weeks. Still, similar flaws keep recurring, which points to harder architectural problems in how container privilege boundaries and hook execution contexts are secured.

References

• NVD - CVE-2025-23266
• MITRE CVE Entry
• NVIDIA Security Advisory
• Wiz Research - NVIDIAScape
• GBHackers - NVIDIA Container Toolkit Vulnerability
• TheCyberThrone - NVIDIA Container Toolkit Vulnerabilities
• Openwall oss-security post

Source: This report was created using AI

If you have suggestions for improvement or feedback, please reach out to us at [email protected]