Inspektor Gadget: crafted ld.so.cache in a container stalls the container-start hook cluster-wide

Impact

While an uprobe-based gadget is active, Inspektor Gadget parses /etc/ld.so.cache from container images to resolve libraries. The parser trusts the header EntryCount, computes a length with overflowing uint32 arithmetic, and builds strings byte by byte, so a crafted cache file turns into quadratic work. The damaging part is where that work happens: pkg/container-hook holds the fanotify container-start pause for the duration, so one unprivileged tenant container can delay container startup by roughly a minute, stop Docker from starting other containers on that node, and blind monitoring while it does. On a GPU node that is a scheduling stall affecting every other tenant on the box, not just the attacker. The advisory establishes availability impact only - no confidentiality or integrity claim.

Who can reach it

Any tenant who can run an unprivileged container with an image they control on a node where Inspektor Gadget is running an uprobe-based gadget. No elevated container privileges are required. A cache file processed from an already-running container still burns CPU but does not hold the start pause.

What to do

Upgrade Inspektor Gadget to 0.53.1 (affected from 0.27.0). This is a DaemonSet image bump and pod restart on each node - no node drain or reboot. As an interim mitigation, stop running uprobe-based gadgets on nodes that host untrusted tenant workloads.

References

Related entries

• Renovate: minimumReleaseAge is not applied to digest updates, so fresh dependency digests reach CI earlyCVE-2026-88884 · Renovate (minimumReleaseAge enforcement for digest updates)Medium
• Schneider Electric StruxureWare Data Center Expert before 7.4.0: Passwords held in cleartext in RAM on the DCIMCVE-2017-8371 · Schneider Electric StruxureWare Data Center Expert before 7.4.0Medium
• RPMB protocol message authentication subsystem in Intel TXE before 4.0.30 (replay-protected memory block)CVE-2020-12355 · RPMB protocol message authentication subsystem in Intel TXE before 4.0.30 (replay-protected memory block)Medium
• Replay Protected Memory Block (RPMB) protocol as specified for eMMC, UFS and ALL versions of NVMeCVE-2020-13799 · Replay Protected Memory Block (RPMB) protocol as specified for eMMC, UFS and ALL versions of NVMe - multi-vendor…Medium
• IBM Spectrum Scale Container Native Storage Access (CSI volume handling): Anyone who can create a pod plus a PV/PVCCVE-2022-40607 · IBM Spectrum Scale Container Native Storage Access (CSI volume handling)Medium
• AMD - overlap between segmented reverse map table (RMP) and SMM memory: Improper handling of overlap between theCVE-2025-0012 · AMD - overlap between segmented reverse map table (RMP) and SMM memoryMedium