CVE-2025-23279: NVIDIA Installer Privilege Escalation Flaw

CVE-2025-23279 Overview

CVE-2025-23279 is a race condition vulnerability in the NVIDIA .run Installer for Linux and Solaris. A local attacker with low privileges can exploit a time-of-check to time-of-use (TOCTOU) flaw [CWE-367] during installation to escalate privileges on the host. Successful exploitation may lead to code execution, privilege escalation, information disclosure, denial of service, or data tampering. The vulnerability requires local access and high attack complexity, but the impact spans confidentiality, integrity, and availability. NVIDIA has published a customer support advisory addressing the issue.

Critical Impact
Successful exploitation grants an unprivileged local user the ability to execute arbitrary code with elevated privileges on Linux and Solaris systems running vulnerable NVIDIA .run installers.

Affected Products

NVIDIA .run Installer for Linux
NVIDIA .run Installer for Solaris
NVIDIA GPU driver packages distributed via the .run installer

Discovery Timeline

2025-08-02 - CVE-2025-23279 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23279

Vulnerability Analysis

The vulnerability is a race condition classified under [CWE-367]: Time-of-check Time-of-use (TOCTOU). The NVIDIA .run installer validates a resource state and later acts on that resource without ensuring the state has not changed. A local attacker with low privileges can win the race window between validation and use to substitute attacker-controlled content in a path the installer trusts.

Because the installer executes with elevated privileges during driver installation, winning the race yields code execution in a privileged context. The result is a full compromise of the local system's confidentiality, integrity, and availability. Exploitation requires local access and precise timing, reflecting the high attack complexity.

Root Cause

The root cause is non-atomic handling of filesystem objects during installation. The installer checks a file, directory, or symbolic link state and later re-accesses the same path, assuming the state is unchanged. An attacker with write access to a parent directory or intermediate path can swap the target between these two operations.

Attack Vector

An authenticated local user places or manipulates filesystem objects that the installer touches while running as root. By racing the installer, the attacker redirects privileged file operations to attacker-controlled paths. This can overwrite sensitive files, drop setuid binaries, or execute code as root. Exploitation is not remote and requires the attacker to be present on the host while a privileged installation or reinstallation is executed. See the NVIDIA Customer Support Answer for vendor guidance.

No verified public exploit code is available for CVE-2025-23279. The vulnerability mechanism is described in prose above; see NVIDIA's advisory for authoritative technical details.

Detection Methods for CVE-2025-23279

Indicators of Compromise

Unexpected creation of setuid root binaries in directories touched by the NVIDIA installer during or shortly after driver installation.
Symbolic links appearing under installer working directories such as /tmp that point to sensitive system files owned by root.
Modification of files outside the expected NVIDIA driver install paths while the .run installer is executing.

Detection Strategies

Audit filesystem activity generated by NVIDIA .run installer processes using Linux Audit (auditd) rules targeting installer child processes.
Correlate installer execution events with concurrent file writes or symlink creation by non-root users in shared directories.
Compare installed driver file hashes against NVIDIA-published values after installation completes to identify tampering.

Monitoring Recommendations

Alert on execution of nvidia-installer or .run installer scripts outside of change-management windows.
Monitor /tmp, /var/tmp, and installer temporary directories for suspicious symlink or file races during installations.
Log privilege transitions to root originating from installer subprocesses and review for unexpected command execution.

How to Mitigate CVE-2025-23279

Immediate Actions Required

Apply the NVIDIA-provided patched .run installer version referenced in the NVIDIA Customer Support Answer before running any further driver installations.
Restrict local shell access on systems where NVIDIA drivers are installed or updated to trusted administrators only.
Perform driver installations on single-user maintenance sessions to eliminate concurrent local activity during the vulnerable window.

Patch Information

NVIDIA has released a fixed version of the .run installer. Consult the NVIDIA Customer Support Answer 5670 for the corrected installer versions for Linux and Solaris and download the updated package from official NVIDIA distribution channels before performing any installation or reinstallation.

Workarounds

Run the installer only from a directory writable exclusively by root to reduce the attacker's ability to manipulate paths.
Terminate all non-administrative local sessions before executing the NVIDIA .run installer.
Where package-managed NVIDIA drivers are available for the distribution, use those packages instead of the .run installer until patched.

bash

# Verify installer integrity and run in a root-only working directory
sudo mkdir -p /root/nvidia-install && sudo chmod 700 /root/nvidia-install
sudo mv NVIDIA-Linux-x86_64-<version>.run /root/nvidia-install/
cd /root/nvidia-install
sudo sha256sum NVIDIA-Linux-x86_64-<version>.run
sudo ./NVIDIA-Linux-x86_64-<version>.run