NVIDIA Confidential Computing (H100/H200/B100/B200/GB200) - CC-DevTools operating mode: NVIDIA GPU confidential
Impact
NVIDIA GPU confidential computing has three modes - CC-Off, CC-On and CC-DevTools. DevTools mode exists so that profilers and debuggers keep working, and it does so by disabling the protections: the GPU still produces attestation material and still looks like a confidential GPU to tooling, but the confidentiality guarantee is not in force. This is a configuration state, not a bug, and it is the single most likely way an operator ships a 'confidential' GPU that is not one.
Who can reach it
No attacker skill required - the risk is that the mode is set wrong, or set right and then changed by an operator debugging a performance problem and never changed back. Anyone with host root can set it.
What to do
Not patchable; it is a control you must enforce. Verify CC mode per GPU as a continuous check rather than a build-time one, and make the attestation policy reject DevTools mode explicitly rather than accepting any signed report. Changing CC mode requires a GPU reset and therefore a node drain, which is also why operators are tempted to leave a node in DevTools mode once they set it.
References
Related entries
- NVIDIA Confidential Computing (H100/H200/B100/B200/GB200) - CC-DevTools operating mode: NVIDIA GPU confidentialNCVD-2023-004-nvidia-confidential-computing-h1 · NVIDIA Confidential Computing (H100/H200/B100/B200/GB200) - CC-DevTools operating modeUnscored
- NVIDIA Remote Attestation Service (NRAS) / NVIDIA attestation SDK: Verifying an NVIDIA GPU attestation reportNCVD-2024-003-nvidia-remote-attestation-servic · NVIDIA Remote Attestation Service (NRAS) / NVIDIA attestation SDKUnscored
- NVIDIA GDDR6 GPU memory (A6000-class and similar discrete GPUs): The first demonstrated Rowhammer bit flips in GPUNCVD-2025-003-nvidia-gddr6-gpu-memory-a6000-cl · NVIDIA GDDR6 GPU memory (A6000-class and similar discrete GPUs)Unscored
- NVIDIA GPUs with GDDR6 and no on-die ECC - demonstrated on RTX A6000NCVD-2025-008-nvidia-gpus-with-gddr6-and-no-on · NVIDIA GPUs with GDDR6 and no on-die ECC - demonstrated on RTX A6000. Not reproduced on A100 (HBM), H100 or RTX…Unscored
- NVIDIA GPUs with GDDR6 and no on-die ECC - demonstrated on RTX A6000NCVD-2025-011-nvidia-gpus-with-gddr6-and-no-on · NVIDIA GPUs with GDDR6 and no on-die ECC - demonstrated on RTX A6000. Not reproduced on A100 (HBM), H100 or RTX…Unscored
- NVIDIA GDDR6 GPU memory (A6000-class and similar discrete GPUs): The first demonstrated Rowhammer bit flips in GPUNCVD-2025-014-nvidia-gddr6-gpu-memory-a6000-cl · NVIDIA GDDR6 GPU memory (A6000-class and similar discrete GPUs)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.