Database/Control plane, storage & DevOps

DMTF libspdm - SPDM session establishment (reference implementation used in GPU/device attestation): A device

CVSS 9.1CVE-2023-31127Control plane, storage & DevOpslibspdm session establishment bypasscurated

Impact

A device supporting both DHE and PSK sessions with mutual authentication can be driven into establishing a session with KEY_EXCHANGE plus PSK_FINISH, bypassing mutual authentication entirely. Scored 9.1 with a changed scope. This matters far beyond libspdm itself: SPDM is the protocol underneath device attestation and the encrypted host-to-device channel in confidential GPU computing and in PCIe/CXL IDE, and libspdm is the reference code many silicon and firmware vendors derived from. If your accelerator's attestation stack forked libspdm before 2.3.1, ask the vendor directly.

Who can reach it

An attacker on an adjacent path with low privileges - in the device context, something able to speak SPDM to the responder, which means the platform firmware, a DPU, or a compromised device on the link.

What to do

Update to libspdm 2.3.1 or later. Cost for an operator is indirect and slow: you do not deploy libspdm, your GPU/DPU/NIC firmware vendor does, so the action is a supply-chain question to each vendor and then a firmware update on their schedule. Firmware flash means node drain. Track it as a vendor-management item rather than a patch you can apply.

References

https://github.com/DMTF/libspdm/security/advisories/GHSA-qw76-4v8p-xq9f https://nvd.nist.gov/vuln/detail/CVE-2023-31127

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.