NVIDIA GPU firmware microcontroller (Falcon): MULTI-TENANT ISOLATION: a privileged user can craft microcode

Impact

MULTI-TENANT ISOLATION: a privileged user can craft microcode that the GPU's internal microcontroller accepts as valid. That means loading attacker-controlled firmware onto the GPU, below the driver and below the OS - persistent, invisible to host tooling, and NVIDIA explicitly notes the scope may extend to other components. On a bare-metal GPU rental this is the tenant-persistence scenario: tenant A leaves code on the card that outlives the reprovision and is there when tenant B arrives. Verify with the vendor whether a full VBIOS and firmware reflash between tenants is sufficient.

Who can reach it

A user with elevated privileges on the host. On rented bare metal that is the tenant; on a managed cluster it is anyone who got root on a node.

What to do

NVIDIA shipped the fix in GPU firmware/microcode delivered with the R470 and R450 driver branches and, on some SKUs, in an updated VBIOS. On most datacenter parts the microcontroller image is loaded by the driver at GPU init, so a driver upgrade plus a node reboot applies it; check the bulletin's product table, because a subset of boards also needs an out-of-band VBIOS/InfoROM update, which is an offline per-node flash with the GPU idle. Either way the node has to be drained. Because this is a firmware-persistence risk, also add a firmware/VBIOS attestation or reflash step to your bare-metal tenant handoff - patching alone does not tell you whether a previous tenant already loaded something.

References