CVE-2025-23267
Description
A flaw was found in nvidia-container-toolkit. The update-ldcache hook contains a vulnerability allowing an attacker to trigger link following via a specially crafted container image. This issue allows a local attacker to potentially cause data corruption. The root cause is the improper handling of container image paths during the link cache update process, which may result in data loss.
Statement
RHEL AI is not affected because it uses CDI mode with NVIDIA Container Toolkit versions later than 1.17.5, which are not vulnerable, and does not rely on the enable-cuda-compat hook, thereby eliminating the attack vector entirely.
This vulnerability is rated as Important instead of Critical because, while it involves a symlink attack via the update-ldcache hook in the NVIDIA Container Toolkit, it has limited impact and specific requirements. The attacker needs low privileges inside a container and must use a specially crafted image to trigger the issue. It does not lead to code execution or privilege escalation, and it has no impact on confidentiality—only potential data tampering or denial of service. Additionally, the vulnerability affects only setups using this specific hook and can be easily mitigated by disabling it.
Mitigation
This vulnerability can be mitigated by opting out using the enable-cuda-compat hook. When using the NVIDIA Container Runtime in legacy mode, you can opt out of using the enable-cuda-compat hook by editing the /etc/nvidia-container-toolkit/config.toml file to set the features.disable-cuda-compat-lib-hook feature flag to true:
[features]
disable-cuda-compat-lib-hook = true
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other
Technical Impact: Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
