Back Linuxsecurity

openSUSE: Critical Privilege Escalation Issues in nvidia-container

Linuxsecurity •LinuxSecurity Advisories • November 24, 2025

This update for nvidia-container-toolkit fixes the following issues: * Update to version 1.18.0: * This is a major release and includes the following high-level changes: * The default mode of the NVIDIA Container Runtime has been updated to make use of a just-in-time-generated CDI specification instead of defaulting to the legacy mode. * Added a systemd unit to generate CDI specifications for available devices automatically. This allows native CDI support in container engines such as Docker and Podman to be used without additional steps. * Security issues fixed: * CVE-2024-0133: Fixed data tampering in host file system via specially crafted container image (bsc#1231032) * CVE-2024-0132: Fixed time-of-check time-of-use (TOCTOU) race condition in default configuration via specifically crafted container image (bsc#1231033) * CVE-2024-0134: Fixed specially-crafted container image can lead to the creation of unauthorized files on the host (bsc#1232855) *

## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-4187=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-4187=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2025-4187=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2025-4187=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2025-4187=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2025-4187=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-4187=1 * Containers Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Containers-15-SP6-2025-4187=1 * Containers Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Containers-15-SP7-2025-4187=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2025-4187=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-4187=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-4187=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-4187=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-4187=1 * SUSE Linux Enterprise Server 15 SP3 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2025-4187=1

* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1 * Containers Module 15-SP6 (aarch64 ppc64le x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1 * Containers Module 15-SP7 (aarch64 ppc64le x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1 * SUSE Linux Enterprise Server 15 SP3 LTSS (aarch64 ppc64le x86_64) * nvidia-container-toolkit-1.18.0-150200.5.17.1

* bsc#1231032 * bsc#1231033 * bsc#1232855 * bsc#1236496 * bsc#1236497 * bsc#1236498 * bsc#1237085 * bsc#1246614 * bsc#1246860 ## References: * * * * * * * * * * * * * * * * * *

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SUSE and openSUSE Release Critical nvidia-container-toolkit Update SUSE and openSUSE have released an update for the nvidia-container-toolkit, addressing critical issues including data tampering and privilege escalation. The update, version 1.18.0, introduces a new default mode for the NVIDIA Container Runtime that utilizes a just-in-time-generated CDI specification, enhancing compatibility with container engines like Docker. 2 sources 27

Extracted Entities

CVEs (3)

CVE-2024-0132 CVE-2024-0133 CVE-2024-0134