NVIDIA Container Toolkit TOCTOU Container Escape

This repository is a proof-of-concept (PoC) exploit for CVE-2024-0132, targeting NVIDIA's nvidia-container-toolkit on Linux systems. The exploit demonstrates how a malicious container, when run with the NVIDIA runtime and GPU access, can escape its isolation and access files from the host filesystem and interact with the host's Docker daemon via the docker.sock UNIX socket. The repository contains multiple versions (v0.1, v0.2, v0.3), each with a Dockerfile and an entrypoint.sh script. The exploit works by creating symlinks within the container that point to host directories, then using these to read sensitive files (e.g., /etc/hostname) and communicate with the Docker daemon. The main payload is a bash script executed as the container's entrypoint. The PoC is operational and demonstrates real host compromise potential, but does not include weaponized or automated post-exploitation features. The README provides detailed setup and reproduction steps, including environment requirements and affected versions.

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-0132, a TOCTOU (Time-of-Check to Time-of-Use) vulnerability in the NVIDIA container toolkit (libnvidia-container) on Linux systems. The exploit is implemented as a Dockerfile that sets up a specific directory and symlink structure to abuse the way the toolkit mounts libraries from /usr/local/cuda/compat/ into the container. By carefully crafting directories and symlinks, the PoC demonstrates how an attacker could trick the mounting logic into mounting arbitrary host files or directories into the container, potentially leading to privilege escalation or access to sensitive host data. The repository contains two files: a Dockerfile with the exploit logic and a README.md that explains the vulnerability, the exploit steps, and references to the relevant code in the NVIDIA toolkit. The exploit is local in nature, requiring the ability to build and run Docker containers with the NVIDIA toolkit.