# NVIDIAScape - Critical NVIDIA AI Vulnerability: A Three-Line Container Escape in NVIDIA Container Toolkit (CVE-2025-23266)

NVIDIA Container Toolkit's createContainer hook inherited container env vars, so LD_PRELOAD in a Dockerfile loaded attacker .so into a privileged host process, escaping to root.

- Payout: Research
- Severity: critical
- Program: NVIDIA Container Toolkit
- Credited: Wiz Research
- Disclosed: 2025-07-17
- CVE: CVE-2025-23266
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/nvidia-ai-vulnerability-cve-2025-23266-nvidiascape
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nvidia-ai-vulnerability-cve-2025-23266-nvidiascape
- Tags: domain:cloud impact:internal-access impact:privesc impact:rce kind:research platform:threat-intel sev:critical tech:docker tech:linux technique:source-review vuln:misconfiguration vuln:privilege-escalation vuln:rce

**Target:** OCI createContainer hook (nvidia-ctk enable-cuda-compat) in NVIDIA Container Toolkit
**Root cause:** The createContainer OCI hook inherits environment variables from the container image and runs with its working directory set to the container root filesystem, so attacker-controlled LD_PRELOAD loads a malicious .so into the privileged host hook process.
**Steps:**
1. Build image with Dockerfile: `FROM busybox`, `ENV LD_PRELOAD=/proc/self/cwd/poc.so`, `ADD poc.so /`
2. Compile poc.so whose constructor runs `id` and writes output to `/owned` on host
3. `docker build . -t nct-exploit`
4. Run on host with vulnerable NCT: `docker run --rm --runtime=nvidia --gpus=all nct-exploit`
5. nvidia-ctk createContainer hook inherits LD_PRELOAD, loads /proc/self/cwd/poc.so from container rootfs, executes as host root
**How found:** Wiz Research scrutinized the NVIDIA Container Toolkit after prior container-escape findings (CVE-2024-0132); they examined OCI hook semantics and noticed createContainer hooks inherit container env vars and run with cwd at the container rootfs, hypothesizing LD_PRELOAD abuse.
**Exploitation:** Attacker supplies a container image (untrusted/public image, supply chain, or multi-tenant GPU service) containing a malicious .so and LD_PRELOAD env var; when run with the NVIDIA runtime, the privileged createContainer hook loads the library and executes attacker code as root on the host, enabling access to other tenants' data and models on shared GPU infrastructure.
**Escalation:** In multi-tenant managed AI cloud services, escaping to host root lets attacker read/steal/manipulate other customers' models and data on shared GPU hardware.
**Insight:** OCI createContainer hooks (unlike prestart hooks) inherit the container's environment and run with cwd inside the container rootfs — audit any privileged host hook for LD_PRELOAD/LD_LIBRARY_PATH and relative-path library loading, and test with a three-line Dockerfile.