NVIDIA CUDA Driver Vulnerability Allows GPU Memory Snooping from Unprivileged Containers
Overview
A high-severity privilege escalation and information disclosure vulnerability was discovered in the NVIDIA Linux driver stack, impacting multi-tenant GPU environments commonly found in cloud computing and on-premise Kubernetes clusters. The flaw, assigned CVE-2025-45123, existed in the driver's handling of GPU memory mappings for containerized processes. Specifically, a use-after-free condition in the Unified Memory Management (UMM) subsystem could be triggered by a malicious container. An attacker with standard, non-privileged user access inside a container that has been allocated a GPU slice could exploit this vulnerability to gain read and write access to arbitrary physical memory addresses on the GPU device. This effectively bypasses the memory isolation enforced by the IOMMU and the NVIDIA driver, which is designed to prevent one container from accessing another's GPU memory. A malicious actor could leverage this flaw to snoop on the VRAM of other containers sharing the same physical GPU, allowing for the exfiltration of highly sensitive data in real-time. This could include proprietary ML model weights, confidential datasets being processed for training, or inference requests and results containing PII. Furthermore, the arbitrary write capability could be used to corrupt critical data structures in the GPU memory of other containers or even the host kernel's driver state, potentially leading to a denial-of-service or a full container escape to compromise the underlying host node. NVIDIA released patched driver versions and advised all multi-tenant GPU administrators to update their host systems immediately.
Affected Systems
Testing Guide
1. On the host machine or within a privileged container, run `nvidia-smi` to check the installed driver version. 2. Compare the installed version with the patched versions listed in the NVIDIA security bulletin. 3. A proof-of-concept exploit is available from security researchers. Run the PoC in a dedicated, isolated test environment (NEVER in production) with two containers scheduled on the same GPU. The PoC will attempt to read a known data pattern from the memory of container A while running from container B. If the pattern is read successfully, the system is vulnerable.
Mitigation Steps
1. Update the host system's NVIDIA driver to a patched version (e.g., 565.37 or newer). 2. For cloud users on IaaS, ensure your VM instances are using a patched machine image provided by your cloud service provider. 3. In Kubernetes, use `node-feature-discovery` to label nodes with their driver version and use node selectors to schedule sensitive workloads only on patched nodes. 4. Avoid scheduling untrusted workloads on the same physical GPU as trusted, sensitive workloads.
Patch Details
Patches are available in NVIDIA driver branches 565.x (version 565.37 and later) and 560.x (version 560.99 and later).