Cybersecurity researchers have uncovered that a patch for a critical vulnerability in the NVIDIA Container Toolkit remains incomplete, potentially exposing sensitive data to risk. The original vulnerability (CVE-2024-0132), which received a high severity CVSS score of 9.0, involves a Time-of-Check Time-of-Use (TOCTOU) flaw that could enable container escape attacks and unauthorized host access.
Although NVIDIA addressed this vulnerability in September 2024, Trend Micro’s analysis reveals the fix is insufficient. Additionally, researchers identified a related performance issue affecting Docker on Linux that could trigger denial-of-service conditions.
“These issues could enable attackers to escape container isolation, access sensitive host resources, and cause severe operational disruptions,” explained Trend Micro researcher Abdelrahman Esmail.
The persistent TOCTOU vulnerability allows specially crafted containers to access the host file system and execute arbitrary commands with root privileges. This affects version 1.17.4 when the “allow-cuda-compat-libs-from-container” feature is enabled.
“The specific flaw exists within the mount_files function,” Trend Micro noted. “The issue results from the lack of proper locking when performing operations on an object.”
This vulnerability, now designated as CVE-2025-23359 with a CVSS score of 9.0, was previously identified by cloud security firm Wiz as a bypass for CVE-2024-0132 in February 2025. It has been fixed in version 1.17.4.
Researchers also discovered a performance issue that could lead to DoS vulnerabilities on Linux-based Docker hosts. When containers with multiple mounts using “bind-propagation=shared” are created, the associated entries remain in the Linux mount table after container termination, causing uncontrolled growth that exhausts file descriptors and prevents new container creation.
Recommended mitigation strategies include:
– Monitoring Linux mount tables for abnormal growth
– Limiting Docker API access to authorized personnel
– Enforcing strong access control policies
– Conducting regular audits of container-to-host filesystem bindings