CVE-2023-31035: SMM-Level Code Execution in the NVIDIA DGX A100 SBIOS
| CVE | Score | Component | Disclosed |
|---|---|---|---|
| CVE-2023-31035 | 7.5 High | DGX A100 SBIOS — SMI callout | June 2023 |
Part of the broader June 2023 DGX A100/A800 firmware security bulletin.
For executives
The NVIDIA DGX A100 is NVIDIA's flagship AI training server. CVE-2023-31035 is a vulnerability in its SBIOS that allows an attacker to trigger code execution at System Management Mode level. SMM is a privileged execution mode built into x86 processors that operates below the operating system, below the hypervisor, and below any security software. Code running in SMM is invisible to the OS and cannot be terminated by it. No operating system security tool, no EDR, no runtime monitor has any visibility into what SMM code does.
The SMI callout mechanism
SMM is triggered by a System Management Interrupt (SMI). The DGX A100 SBIOS contains an SMI handler that calls out to a memory location the attacker can influence. By placing malicious code at that location before the SMI fires, the attacker causes the SMI handler to execute their code in SMM — with unrestricted access to physical memory and higher privileges than the kernel or hypervisor.
The DGX A100 context
The DGX A100 contains eight A100 GPUs connected via NVLink, 640GB of GPU memory, and network connectivity to the rest of the training cluster. An SMM-level compromise gives an attacker invisible control of one of the most powerful and most data-rich machines in an AI infrastructure. A persistent SMM implant on a DGX A100 running continuously during LLM training has access to the model's evolving weights across the entire training process.
The broader June 2023 DGX bulletin
- CVE-2023-31030: stack overflow in the BMC host KVM daemon. Unauthenticated.
- CVE-2023-31033: missing authentication for a critical BMC function, accessible from an adjacent network.
- CVE-2023-31034: integer overflow in the SBIOS allowing input validation bypass.
Patch
Upgrade to NVIDIA DGX A100 Firmware Update Container Version 23.06.3 or later. BMC ports should be restricted to a dedicated management network and should not be exposed to the Internet.