NVIDIA Confidential Computing (H100/H200/B100/B200/GB200) - CC-DevTools operating mode: MULTI-TENANT ISOLATION: NVIDIA

Impact

MULTI-TENANT ISOLATION: NVIDIA GPU confidential computing has three modes - CC-Off, CC-On and CC-DevTools. DevTools mode exists so that profilers and debuggers keep working, and it does so by disabling the protections: the GPU still produces attestation material and still looks like a confidential GPU to tooling, but the confidentiality guarantee is not in force. This is a configuration state, not a bug, and it is the single most likely way an operator ships a 'confidential' GPU that is not one.

Who can reach it

No attacker skill required - the risk is that the mode is set wrong, or set right and then changed by an operator debugging a performance problem and never changed back. Anyone with host root can set it.

What to do

Not patchable; it is a control you must enforce. Verify CC mode per GPU as a continuous check rather than a build-time one, and make the attestation policy reject DevTools mode explicitly rather than accepting any signed report. Changing CC mode requires a GPU reset and therefore a node drain, which is also why operators are tempted to leave a node in DevTools mode once they set it.

References