CVE-2023-31029

The vulnerability is located in the KVM daemon running within the BMC of the NVIDIA DGX A100 device. An attacker sends a specially crafted network packet that causes a stack buffer overflow (CWE-121, CWE-787) — data is written outside the intended memory area. No authentication or user interaction is required, and the attack can be conducted locally (AV:L vector according to CVSS). Successful exploitation allows the attacker to take control of the BMC process.

An attacker can lead to arbitrary code execution (RCE), denial of service (DoS), information disclosure, and data manipulation at the BMC controller level. BMC compromise potentially provides deep access to hardware management, independent of the host operating system.

Apply patches available from the manufacturer in accordance with references — detailed information about updated firmware versions is available in the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5510

NVIDIA DGX A100 and NVIDIA DGX A100 Firmware software — specific versions indicated in manufacturer references (https://nvidia.custhelp.com/app/answers/detail/a_id/5510)