NVIDIA Patches Critical Bug in High-Performance Servers

guest · Oct 29, 2020

NVIDIA Patches Critical Bug in High-Performance Servers
October 29, 2020
https://threatpost.com/nvidia-critical-bug-hpc/160762/

NVIDIA released a patch for a critical bug in its high-performance line of DGX servers that could open the door for a remote attacker to take control of and access sensitive data on systems typically operated by governments and Fortune-100 companies.

In all, NVIDIA issued nine patches, each fixing flaws in firmware used by DGX high-performance computing (HPC) systems, which are used for processor-intensive artificial intelligence (AI) tasks, machine learning and data modeling. All of the flaws are tied to its own firmware that runs on its DGX AMI baseboard management controller (BMC), the brains behind a remote monitoring service servers.

“Attacks can be remote (in case of internet connectivity), or if bad guys can root one of the boxes and get access to the BMC they can use the out of band management network to PWN the entire datacenter,” wrote researcher Sergey Gordeychik who is credited for finding the bugs. “If you have access to OOB, it is game is over for the target.”
Click to expand...

No Patch Until 2021 for One Bug
NVIDIA said a patch fixing one high-severity bug (CVE‑2020‑11487), specifically impacting its DGX A100 server line, would not be available until the second quarter of 2021. The vulnerability is tied to a hard-coded RSA 1024 key with weak ciphers that could lead to information disclosure. A fix for the same bug (CVE‑2020‑11487), impacting other DGX systems (DGX-1, DGX-2) is available.
Click to expand...

NVIDIA: Security Bulletin: AMI Baseboard Management Controller (BMC) Firmware Vulnerabilities in NVIDIA DGX-1, DGX-2, and DGX A100 Servers - October 2020

Log in or Sign up

NVIDIA Patches Critical Bug in High-Performance Servers

guest Guest

Log in or Sign up

NVIDIA Patches Critical Bug in High-Performance Servers

guest Guest

Useful Searches