NVIDIA DGX BMC (AMI firmware): The PRNG used by the IPMI implementation in the BMC's JSOL package

CVSS 7.5CVE-2020-11616Firmware, BMC & network fabriccurated

Impact

The PRNG used by the IPMI implementation in the BMC's JSOL package is not cryptographically strong, so session identifiers and other 'random' values are predictable. Combined with the rest of this bulletin it removes the guesswork from hijacking BMC/IPMI sessions. DGX-1 before BMC 3.38.30.

Who can reach it

Anyone with network reach to the BMC's IPMI service.

What to do

Flash the DGX BMC firmware from NVIDIA's DGX firmware update container (DGX-1 to 3.38.30 or later, DGX-2 to 1.06.06 or later; DGX A100 per the bulletin's table). A BMC flash does not require the host OS to reboot but drops out-of-band management for several minutes and NVIDIA recommends a host power cycle afterwards, so treat it as a per-node maintenance window. Rotate every BMC and IPMI credential after the flash - flashing does not invalidate secrets an attacker already pulled. Keep BMCs on an isolated management VLAN with no route from tenant or job networks.

References

https://nvd.nist.gov/vuln/detail/CVE-2020-11616

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.