NVIDIA GPU firmware microcontroller (Falcon): MULTI-TENANT ISOLATION: debug registers on the GPU's internal

Impact

MULTI-TENANT ISOLATION: debug registers on the GPU's internal microcontroller are readable at runtime, leaking state from beneath the driver. Listed across the DGX-1, DGX-2 and DGX Station A100 lines as well as the GeForce/Quadro/Tesla range.

Who can reach it

A user with elevated privileges on the GPU host - which in bare-metal GPU rental is the tenant.

What to do

NVIDIA shipped the fix in GPU firmware/microcode delivered with the R470 and R450 driver branches and, on some SKUs, in an updated VBIOS. On most datacenter parts the microcontroller image is loaded by the driver at GPU init, so a driver upgrade plus a node reboot applies it; check the bulletin's product table, because a subset of boards also needs an out-of-band VBIOS/InfoROM update, which is an offline per-node flash with the GPU idle. Either way the node has to be drained.

References