NVIDIA DGX BMC (AMI firmware): The BMC does not validate the RSA-1024 public key used to verify firmware signatures

Impact

The BMC does not validate the RSA-1024 public key used to verify firmware signatures. That breaks the root of trust for BMC firmware updates: an attacker who can push an update can install their own firmware image and persist below the host OS indefinitely. DGX-1 before 3.38.30, DGX-2 before 1.06.06.

Who can reach it

An attacker with access to the BMC's firmware update path - network reach to the management interface, or an administrator session obtained through the other bugs in this bulletin.

What to do

Flash the DGX BMC firmware from NVIDIA's DGX firmware update container (DGX-1 to 3.38.30 or later, DGX-2 to 1.06.06 or later; DGX A100 per the bulletin's table). A BMC flash does not require the host OS to reboot but drops out-of-band management for several minutes and NVIDIA recommends a host power cycle afterwards, so treat it as a per-node maintenance window. Rotate every BMC and IPMI credential after the flash - flashing does not invalidate secrets an attacker already pulled. Keep BMCs on an isolated management VLAN with no route from tenant or job networks.

References