NVIDIA DGX BMC (AMI-derived management controller): The BMC's SPX REST API lets an authorised attacker read and write

Impact

The BMC's SPX REST API lets an authorised attacker read and write arbitrary locations in the IPMI server process memory, reaching code execution inside the BMC. A BMC compromise on a DGX gives an attacker power control, virtual media, serial console and a persistent foothold under the host OS on a node holding eight GPUs.

Who can reach it

Network access to the BMC management interface holding credentials at some authorised level. Whether that is 'remote' depends entirely on how genuinely isolated your OOB network is - in practice most fleets have a jump host, a DCIM integration or a monitoring collector that bridges it.

What to do

Update the DGX BMC firmware bundle per bulletin 5435. Cost: BMC firmware usually updates without draining the GPUs, but the BMC resets and out-of-band access drops for a few minutes. Pair the patch with an actual audit of who can route to the BMC subnet - that control is worth more than the patch.

References