~ / search / GHSA-67jc-hmvg-q4c7

GHSA-67jc-hmvg-q4c7

NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook

Source: GitHub Advisory Database (reviewed) High CVE-2025-23267

Packages

EcosystemPackageAffectedFixed in
Go github.com/NVIDIA/nvidia-container-toolkit < 1.17.8 1.17.8
Go github.com/NVIDIA/k8s-device-plugin < 0.17.3 0.17.3
Go github.com/NVIDIA/gpu-operator < 25.3.2 25.3.2
Go github.com/NVIDIA/mig-parted < 0.12.2 0.12.2

Details

As written in the advisory (Markdown source, shown as plain text).

NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link following by using a specially crafted container image. A successful exploit of this vulnerability might lead to data tampering and denial of service.

References

External links from the advisory. They lead to third-party sites.