CVE-2025-23267
BaseFortify
Publication date: 2025-07-17
Last updated on: 2025-11-04
Assigner: NVIDIA Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nvidia | mig_manager | 0.12.2 |
| nvidia | kubernetes_device_plugin | 0.17.3 |
| nvidia | container_toolkit | 1.17.8 |
| nvidia | gpu_operator | 25.3.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-59 | The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the NVIDIA Container Toolkit's update-ldcache hook, where an attacker can exploit a specially crafted container image to cause a link following. This can lead to data tampering and denial of service. Essentially, it allows an attacker to manipulate container initialization processes to affect system behavior.
How can this vulnerability impact me? :
A successful exploit of this vulnerability might lead to data tampering and denial of service, which means attackers could alter data or disrupt system availability. The CVSS score indicates a high severity with potential impact on system integrity and availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability in NVIDIA Container Toolkit, immediately update to NVIDIA Container Toolkit version 1.17.8 or later and NVIDIA GPU Operator version 25.3.1 or later. If updating is not immediately possible, disable the enable-cuda-compat hook as a workaround: for NVIDIA Container Runtime in legacy mode, set 'features.disable-cuda-compat-lib-hook = true' in the /etc/nvidia-container-toolkit/config.toml file. For NVIDIA GPU Operator, add 'disable-cuda-compat-lib-hook' to the NVIDIA_CONTAINER_TOOLKIT_OPT_IN_FEATURES environment variable in the Toolkit Container, which can be configured via Helm during installation or upgrade. For GPU Operator versions prior to 25.3.1, deploy NVIDIA Container Toolkit 1.17.8 with the appropriate tag. [1]