NVIDIA DGX BMC (AMI-derived management controller): The DGX-1 BMC's IPMI handler allows an authorised attacker

Impact

The DGX-1 BMC's IPMI handler allows an authorised attacker to upload and download arbitrary files, which is enough to plant persistence on the controller or exfiltrate its configuration and credentials. A BMC compromise on a DGX gives an attacker power control, virtual media, serial console and a persistent foothold under the host OS on a node holding eight GPUs.

Who can reach it

Network access to the BMC management interface holding credentials at some authorised level. Whether that is 'remote' depends entirely on how genuinely isolated your OOB network is - in practice most fleets have a jump host, a DCIM integration or a monitoring collector that bridges it.

What to do

Update the DGX BMC firmware bundle per bulletin 5458. Cost: BMC firmware usually updates without draining the GPUs, but the BMC resets and out-of-band access drops for a few minutes. Pair the patch with an actual audit of who can route to the BMC subnet - that control is worth more than the patch.

References