NVIDIA DGX BMC (AMI firmware): An administrative BMC user can pull the hash of the BMC/IPMI user password

CVSS 4.9CVE-2020-11484Firmware, BMC & network fabriccurated

Impact

An administrative BMC user can pull the hash of the BMC/IPMI user password. In practice that means one compromised BMC admin session yields offline-crackable credentials that are frequently reused across an entire DGX fleet - a lateral movement multiplier across every node in the rack. DGX-1 before BMC 3.38.30.

Who can reach it

An attacker who already has administrative access to one BMC, including via the hard-coded credentials in the same advisory.

What to do

Flash the DGX BMC firmware from NVIDIA's DGX firmware update container (DGX-1 to 3.38.30 or later, DGX-2 to 1.06.06 or later; DGX A100 per the bulletin's table). A BMC flash does not require the host OS to reboot but drops out-of-band management for several minutes and NVIDIA recommends a host power cycle afterwards, so treat it as a per-node maintenance window. Rotate every BMC and IPMI credential after the flash - flashing does not invalidate secrets an attacker already pulled. Keep BMCs on an isolated management VLAN with no route from tenant or job networks.

References

https://nvd.nist.gov/vuln/detail/CVE-2020-11484

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.