NVIDIA Container Toolkit

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical, CVSS 9.0+ (Tier 1, CDI-based architecture) │ $15,000 │ $16,000 Critical (Tier 2, deprecated runtime hook, CLI and library stack) │ $10,000 │ $11,000 High, CVSS 7.0 - 8.9 (Tier 1) │ $4,000 │ $5,000 Medium, CVSS 4.0 - 6.9 (Tier 1) │ $2,000 │ $2,500 Low, CVSS 0.1 - 3.9 (Tier 1) │ $300 │ $375 Submit a vulnerability CVE history 1 Last 12 months 10 Lifetime Access control 35 % Code execution 30 % Injection 20 % Info disclosure 10 % Latest advisories Loading the feed Overview The NVIDIA Container Toolkit is the Apache-2.0 collection of libraries and utilities that makes a GPU visible inside a container, and it is effectively mandatory on every GPU-enabled Kubernetes node and every Docker host running CUDA workloads, which today means the overwhelming majority of AI training and inference infrastructure worldwide. Its CVE count is small, ten lifetime, but the severity profile is not: this is the component behind the container-escape class that lets a malicious image reach the GPU host, and on a shared GPU cluster that crosses the single most valuable tenant boundary in the current build-out. NVIDIA pays for it on the public Intigriti program, where the toolkit's CDI-based architecture is a Tier 1 asset paying $300 at the low band up to $15,000 for a CVSS 9.0 and above, with the deprecated hook and CLI stack one tier down at $10,000. sorona.xyz adds 1.25× on top of whatever NVIDIA awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Container Toolkit is a first-class program asset with its own tiering, described by NVIDIA as the collection of libraries and utilities enabling users to build and run GPU-accelerated containers. The CDI-based architecture is Tier 1 and the rest of the toolkit sits one tier down. The CDI path in full: specification generation, the nvidia-ctk tooling that writes it, and the runtime that consumes it to modify an OCI container specification Discovery and injection of devices, mounts, libraries and capabilities into a container as it starts The deprecated stack, still addressed for critical issues at Tier 2: the NVIDIA Container Runtime Hook, the NVIDIA Container CLI and the NVIDIA Container Library The toolkit's own configuration and the CDI specification files it reads, which decide what a container is handed CUDA Toolkit components in the same program across Tiers 1 to 3, covering libNVVM, NVRTC, NVCC, the CUDA libraries and the driver APIs, all proprietary rather than open source Out of scope Null-pointer issues, listed as asset-specific out of scope Compiler Object Tools, which NVIDIA places outside the compiler threat model because they are standalone development and diagnostic tools Theoretical issues with no realistic exploit scenario, and anything requiring complex end-user interaction to reach A crash on malformed input with no demonstrated gain in privilege, which the program treats as an unfinished report rather than a finding Denial of service and distributed denial of service, brute force, spam, social engineering and physical intrusion Attacks that need physical access to the victim's machine, a man in the middle, or an already-compromised account Software that no longer receives security updates, and issues NVIDIA already knew about from its own testing, which are flagged as duplicates Zero-days in in-scope assets reported within 14 days of a patch or mitigation going public, which may be filed but are usually not bounty-eligible Reports that merely state software is out of date or vulnerable without a proof of concept Most-valued findings A container escape through the CDI device-injection path that puts code on the GPU host from inside an untrusted image. That is Tier 1 critical, the $15,000 band, and the class the toolkit's ten published CVEs cluster in. Local privilege escalation to root or to the kernel driver from a toolkit binary, which the program calls out as its named special interest and wants proved rather than inferred from a crash Access-control failures where a container obtains devices, mounts or capabilities it was never granted, the largest published class here at 35% Injection into the generated CDI specification or into the hook and mount handling, where attacker-controlled metadata becomes host-side arguments Cross-tenant information disclosure on a shared GPU node, where one workload reads another's device state or memory On the CUDA side, a bug reaching users of a deployed CUDA program rather than only its developers, which the program says it values above anything needing the nvcc compiler present Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Demonstrate privilege escalation, not a crash: NVIDIA wants proof you can execute code at a higher privilege level than the user running the tool, and a malformed input that only segfaults is not enough Aim at the CDI-based architecture, which the program says it prioritises; the runtime hook, container CLI and container library stack are deprecated, in maintenance mode, and priced as Tier 2 Do not discuss or disclose vulnerability information, including proof-of-concept videos, without NVIDIA's prior written consent Zero-days found in in-scope assets within 14 days of a patch or mitigation going public may be reported but are usually not bounty-eligible File on the NVIDIA Public Bug Bounty program, not the NVIDIA Vulnerability Disclosure Program on the same platform, which has a minimum and maximum bounty of $0 Since 1 July 2025, DLL hijacking findings are classified as Tier 3 submissions regardless of the asset they land on Disclosure NVIDIA's terms require prior written consent before you discuss or disclose anything about the vulnerability, and they name PoC videos on YouTube and Vimeo specifically, so file directly with NVIDIA on Intigriti first. sorona.xyz will not publish, share or describe the finding while that consent is outstanding; it only helps you track the report once NVIDIA has it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability