NVIDIA DGX BMC (AMI firmware): File upload into the BMC that gets automatically processed, yielding remote code

Impact

File upload into the BMC that gets automatically processed, yielding remote code execution on the baseboard management controller of a DGX-1. Code on the BMC is below the host OS: it survives host reinstall, sees the host's memory and storage paths, controls power and firmware, and is invisible to everything running on the node. This is the worst outcome in the DGX-1 BMC set. DGX-1 before BMC 3.38.30.

Who can reach it

Anyone with network reach to the BMC's management interface. Combined with the hard-coded credentials in the same bulletin, that is unauthenticated in practice.

What to do

Flash the DGX BMC firmware from NVIDIA's DGX firmware update container (DGX-1 to 3.38.30 or later, DGX-2 to 1.06.06 or later; DGX A100 per the bulletin's table). A BMC flash does not require the host OS to reboot but drops out-of-band management for several minutes and NVIDIA recommends a host power cycle afterwards, so treat it as a per-node maintenance window. Rotate every BMC and IPMI credential after the flash - flashing does not invalidate secrets an attacker already pulled. Keep BMCs on an isolated management VLAN with no route from tenant or job networks.

References