CVE-2024-0136: NVIDIA Container Toolkit Privilege Escalation

CVE-2024-0136 Overview

CVE-2024-0136 is an improper isolation vulnerability [CWE-653] in the NVIDIA Container Toolkit. A specially crafted container image can allow untrusted code inside the container to gain read and write access to host devices. The flaw is only present when the NVIDIA Container Toolkit is configured in a nondefault way. Successful exploitation can result in code execution, denial of service, privilege escalation, information disclosure, and data tampering on the host. The vulnerability also affects NVIDIA GPU Operator deployments and Linux hosts running these components.

Critical Impact
A malicious container image can escape isolation boundaries and directly access host devices, enabling code execution and privilege escalation on the underlying host.

Affected Products

NVIDIA Container Toolkit (nondefault configurations)
NVIDIA GPU Operator
Linux hosts running the affected toolkit components

Discovery Timeline

2025-01-28 - CVE-2024-0136 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0136

Vulnerability Analysis

The NVIDIA Container Toolkit provisions GPU resources into container runtimes by mounting host devices, libraries, and CDI (Container Device Interface) hooks into the container namespace. When the toolkit runs in a nondefault configuration, the isolation logic that constrains which host devices a container can access is insufficient. A container image crafted to exploit this gap can request or reference host device paths that should remain outside the container boundary.

Once the container obtains a handle to those host devices, code executing inside the container reads and writes directly against them. This breaks the containment model that operators rely on when running untrusted or multi-tenant GPU workloads. The impact scope is Changed because the exploited container acts on resources belonging to the host security authority, which is why the impact extends to host-level code execution, data tampering, and denial of service.

Root Cause

The root cause is a CWE-653 improper separation of privileged operations. The toolkit's device-mounting and hook logic does not fully validate container-supplied inputs against the host device boundary when configured in nondefault modes. As a result, container-controlled data influences which host devices are exposed into the container namespace.

Attack Vector

Exploitation requires an operator to run a malicious container image on a host where the NVIDIA Container Toolkit is deployed in a nondefault configuration. User interaction is required, and the attacker must have privileges to submit or schedule a container image, for example through a CI/CD pipeline, a shared Kubernetes cluster, or a managed GPU service. No verified public proof-of-concept code is available at this time. See the NVIDIA Support Article for vendor-supplied technical details.

Detection Methods for CVE-2024-0136

Indicators of Compromise

Container processes opening handles to host device nodes under /dev that are not part of the expected GPU device set (for example, unexpected access to /dev/sd*, /dev/nvme*, or /dev/mem).
Unexpected mount, mknod, or ioctl activity originating from container PIDs against host device paths.
Container images referencing nonstandard CDI device specifications or hook binaries not published by NVIDIA.

Detection Strategies

Audit NVIDIA Container Toolkit configuration files (/etc/nvidia-container-runtime/config.toml) for deviations from vendor defaults, especially around accept-nvidia-visible-devices-as-volume-mounts and accept-nvidia-visible-devices-envvar-when-unprivileged.
Baseline the set of host devices legitimately exposed to GPU workloads and alert on containers accessing device nodes outside that baseline.
Scan container images in registries for suspicious mount hints, symlinks pointing to host paths, or unexpected NVIDIA_VISIBLE_DEVICES values.

Monitoring Recommendations

Enable Linux audit rules on open, openat, and ioctl syscalls targeting /dev/* from containerized processes.
Forward container runtime logs and Kubernetes admission events to a central data lake for correlation across nodes.
Track process lineage from containerd-shim or runc to detect host-device I/O initiated from within container cgroups.

How to Mitigate CVE-2024-0136

Immediate Actions Required

Update the NVIDIA Container Toolkit and NVIDIA GPU Operator to the fixed versions listed in the NVIDIA Support Article.
Inventory all hosts running the toolkit and identify any that use nondefault configuration options, since only nondefault configurations are exploitable.
Restrict who can submit container images to GPU-enabled nodes and enforce image signing and provenance checks.

Patch Information

NVIDIA published fixed releases of the NVIDIA Container Toolkit and NVIDIA GPU Operator addressing CVE-2024-0136. Refer to the NVIDIA Support Article for the exact fixed version numbers, upgrade instructions, and configuration guidance. Apply the vendor patch on every affected node before restoring untrusted workloads.

Workarounds

Revert the NVIDIA Container Toolkit to its default configuration until patched versions can be deployed.
Disable acceptance of NVIDIA_VISIBLE_DEVICES as a volume mount source and reject untrusted values from unprivileged containers.
Use Kubernetes admission controllers or Pod Security Standards to block containers that request host device mounts outside the sanctioned GPU device set.

bash

# Configuration example - restore safer defaults in /etc/nvidia-container-runtime/config.toml
accept-nvidia-visible-devices-as-volume-mounts = false
accept-nvidia-visible-devices-envvar-when-unprivileged = false