{"id":4746,"date":"2025-02-12T14:58:22","date_gmt":"2025-02-12T14:58:22","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/here-are-a-few-rewritten-options-that-fit-within-the-50-60-character-limit-researchers-discover-nvidia-patch-bypass-exploit-new-exploit-found-for-patched-nvidia-container-toolkit-research\/"},"modified":"2025-02-12T14:58:23","modified_gmt":"2025-02-12T14:58:23","slug":"here-are-a-few-rewritten-options-that-fit-within-the-50-60-character-limit-researchers-discover-nvidia-patch-bypass-exploit-new-exploit-found-for-patched-nvidia-container-toolkit-research","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/here-are-a-few-rewritten-options-that-fit-within-the-50-60-character-limit-researchers-discover-nvidia-patch-bypass-exploit-new-exploit-found-for-patched-nvidia-container-toolkit-research\/","title":{"rendered":"Here are a few rewritten options that fit within the 50-60 character limit:\n\n* “Researchers discover NVIDIA patch bypass exploit”\n* “New exploit found for patched NVIDIA Container Toolkit”\n* “Researchers uncover NVIDIA vulnerability bypass”"},"content":{"rendered":"\n<\/p>\n

NVIDIA Container Toolkit Vulnerability: A Bypass for a Now-Patched Security Vulnerability<\/strong><\/p>\n

February 12, 2025<\/strong><\/p>\n

By Ravie Lakshmanan<\/strong><\/p>\n

A new vulnerability has been discovered in the NVIDIA Container Toolkit that could be exploited to break out of a container’s isolation protections and gain complete access to the underlying host. The vulnerability, tracked as CVE-2025-23359<\/strong> (CVSS score: 8.3), affects all versions up to and including 1.17.3 and has been fixed in version 1.17.4.<\/p>\n

The Vulnerability<\/strong><\/p>\n

The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) vulnerability in the NVIDIA Container Toolkit for Linux, which can be exploited when used with default configuration. A crafted container image can gain access to the host file system, allowing an attacker to execute code, deny service, escalate privileges, disclose information, and tamper with data.<\/p>\n

Impact<\/strong><\/p>\n

The vulnerability enables bad actors to mount the host’s root file system into a container, granting them unfettered access to all files. Furthermore, the access can be leveraged to launch privileged containers and achieve full host compromise via the runtime Unix socket.<\/p>\n

Analysis<\/strong><\/p>\n

Security researchers from Wiz analyzed the container toolkit and found that the file paths used during mount operations could be manipulated using a symbolic link, allowing an attacker to mount from outside the container into a path within "\/usr\/lib64".<\/p>\n

Recommendations<\/strong><\/p>\n

To mitigate the risk, users of the NVIDIA Container Toolkit are recommended to:<\/p>\n