PT-2020-12640

Name of the Vulnerable Software and Affected Versions NVIDIA DGX-1 versions prior to 3.38.30 NVIDIA DGX-2 versions prior to 1.06.06 Description The issue is related to the AMI BMC firmware in NVIDIA DGX servers, where the software does not validate the RSA 1024 public key used to verify the...

CVE-2020-11615: Use of Hard-coded Credentials

NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which it uses a hard-coded RC4 cipher key, which may lead to information disclosure...

CVE-2020-11483: Use of Hard-coded Credentials

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which the firmware includes hard-coded credentials, which may lead to elevation of privileges or information...

CVE-2020-11484: Undefined Security Weakness

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmware in which an attacker with administrative privileges can obtain the hash of the BMC/IPMI user password, which may lead to information disclosure...

CVE-2020-11488: Improper Verification of Cryptographic Signature

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which software does not validate the RSA 1024 public key used to verify the firmware signature, which may lead t...

CVE-2020-11486: Unrestricted Upload of File with Dangerous Type

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software allows an attacker to upload or transfer files that can be automatically processed within the product's environment, which may lead to remote code execution...

CVE-2020-11487: Use of Hard-coded Credentials

NVIDIA DGX servers, DGX-1 with BMC firmware versions prior to 3.38.30. DGX-2 with BMC firmware versions prior to 1.06.06 and all DGX A100 Servers with all BMC firmware versions, contains a vulnerability in the AMI BMC firmware in which the use of a hard-coded RSA 1024 key with weak ciphers may le...

PT-2020-12639

Name of the Vulnerable Software and Affected Versions NVIDIA DGX-1 versions prior to 3.38.30 NVIDIA DGX-2 versions prior to 1.06.06 NVIDIA DGX A100 Servers all BMC firmware versions Description The issue is related to the use of a hard-coded RSA 1024 key with weak ciphers in the AMI BMC firmware,...

PT-2020-12728

Name of the Vulnerable Software and Affected Versions NVIDIA DGX servers versions prior to 3.38.30 Description The issue concerns the use of a hard-coded RC4 cipher key in the AMI BMC firmware, which may lead to information disclosure. Recommendations For versions prior to 3.38.30, update to...

PT-2020-12635

Name of the Vulnerable Software and Affected Versions NVIDIA DGX-1 versions prior to 3.38.30 NVIDIA DGX-2 versions prior to 1.06.06 Description The issue concerns hard-coded credentials in the AMI BMC firmware, which may result in elevation of privileges or information disclosure. Recommendations...

PT-2020-12637

Name of the Vulnerable Software and Affected Versions NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 Description The issue is related to a Cross-Site Request Forgery CSRF vulnerability in the AMI BMC firmware. This vulnerability occurs because the web application does n...

PT-2020-12638

Name of the Vulnerable Software and Affected Versions NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 Description The issue allows an attacker to upload or transfer files that can be automatically processed within the product's environment, which may lead to remote code...

PT-2020-12636

Name of the Vulnerable Software and Affected Versions NVIDIA DGX servers versions prior to BMC firmware 3.38.30 Description The issue allows an attacker with administrative privileges to obtain the hash of the BMC/IPMI user password, potentially leading to information disclosure. This is due to a...

CVE-2020-11485: Cross-Site Request Forgery (CSRF)

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery CSRF vulnerability in the AMI BMC firmware in which the web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the...

CVE-2020-11489: Initialization of a Resource with an Insecure Default

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain a vulnerability in the AMI BMC firmware in which default SNMP community strings are used, which may lead to information disclosure...

CVE-2020-11616: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which the Pseudo-Random Number Generator PRNG algorithm used in the JSOL package that implements the IPMI protocol is not cryptographically strong, which may lead to information...

PT-2020-12729

Name of the Vulnerable Software and Affected Versions NVIDIA DGX servers versions prior to 3.38.30 Description The issue is related to a weakness in the Pseudo-Random Number Generator PRNG algorithm used in the JSOL package, which implements the IPMI protocol in the AMI BMC firmware. This weaknes...

PT-2020-12641

Name of the Vulnerable Software and Affected Versions NVIDIA DGX-1 versions prior to 3.38.30 NVIDIA DGX-2 versions prior to 1.06.06 Description The issue concerns the use of default SNMP community strings in the AMI BMC firmware, potentially leading to information disclosure. Recommendations For...

Security Bulletin: AMI Baseboard Management Controller (BMC) Firmware Vulnerabilities in NVIDIA DGX-1, DGX-2, and DGX A100 Servers - October 2020

NVIDIA has released a firmware security update for NVIDIA DGX™ servers. This update addresses security issues in the AMI Baseboard Management Controller BMC firmware that may lead to remote code execution, elevation of privileges, or information disclosure. All issues require network access to th...

Security Bulletin: NVIDIA Driver Security Updates for CPU Speculative Side Channel Vulnerabilities

NVIDIA driver response to CPU speculative side channel vulnerabilities - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754 Bulletin Summary NVIDIA is providing an initial security update to mitigate aspects of Google Project Zero’s January 3, 2018 publication of novel information disclosure attacks tha...