NVIDIA NVDebug tool: The NVDebug diagnostic collector lets an actor gain access to a privileged account, reaching code

Impact

The NVDebug diagnostic collector lets an actor gain access to a privileged account, reaching code execution and privilege escalation with a changed scope. NVDebug runs on DGX/HGX platform hosts and is exactly the tool an operator runs as root when something is already wrong.

Who can reach it

Local, low privileges, with user interaction - typically an operator running NVDebug on a node where an attacker already has an unprivileged foothold.

What to do

Update NVDebug per bulletin 5696. Cost: it is a standalone tool, so updating costs nothing operationally. The real control is to stop running old NVDebug bundles as root on nodes you already suspect are compromised.

References