NVIDIA HGX / DGX (Hopper and Blackwell) - GPU VBIOS: MULTI-TENANT ISOLATION: A VBIOS misconfiguration lets an attacker

Impact

MULTI-TENANT ISOLATION: A VBIOS misconfiguration lets an attacker set an unsafe GPU debug access level. Debug access on a datacenter GPU is the setting that gates whether host-side tooling can inspect GPU internal state - raising it on a shared or confidential-computing node undercuts the platform's own claim that tenant state is opaque. NVIDIA scores the direct impact as denial of service with a changed scope, but the interesting property is that the security posture of the GPU is settable from software.

Who can reach it

Local, low privileges, with high attack complexity. The attacker needs code on the host, not inside a guest - so this matters most where you run tenant containers on bare metal rather than behind a hypervisor.

What to do

Apply the VBIOS update in NVIDIA bulletin 5674. Cost: a VBIOS flash on an HGX baseboard covers all eight GPUs on the board and requires a full node drain plus power cycle - you cannot flash per-GPU while jobs run. Fold it into your next planned firmware-bundle window rather than treating it as a hotfix; NVIDIA ships HGX firmware as a bundle (VBIOS + NVSwitch + ERoT) and mixing versions is unsupported.

References