Skip to main content

NVLink as a Lateral Movement Vector: GPU Interconnect in Data Centre Attack Scenarios

For executives​

NVLink is NVIDIA's high-bandwidth GPU interconnect, providing bandwidth up to 900 GB/s for intra-node communication. It is designed for performance. Its security implications — who can communicate over NVLink, what isolation it enforces between GPUs from different tenants, and whether it can be used as a lateral movement path — are significantly less studied than its performance characteristics. This article covers what is known about NVLink's security surface and why it matters for AI infrastructure security teams.

Within an NVIDIA DGX H100 node, eight H100 GPUs are connected via NVLink 4.0 providing up to 900 GB/s bidirectional bandwidth per GPU. Across nodes, NVLink Switch systems connect racks of DGX nodes with all-to-all GPU connectivity.

From a security perspective, NVLink creates a high-bandwidth data path between GPUs that operates below the CPU and OS layer. Normal network monitoring tools observe TCP/IP traffic. NVLink traffic does not traverse conventional network interfaces — it travels on a dedicated GPU fabric that is invisible to standard network monitoring.

The lateral movement scenario​

NVLink Peer-to-Peer (P2P) memory access is a legitimate CUDA feature: a CUDA program on GPU 0 can directly read from or write to the memory of GPU 1 via NVLink, subject to the two processes having explicitly enabled P2P access.

An attacker who has kernel-level access on the host can potentially enable P2P access between GPUs that belong to different tenants, creating a cross-tenant NVLink read path. In a multi-GPU node where different tenants are assigned different GPUs via MIG or scheduling, kernel-level access bypasses the software controls that prevent P2P between tenant GPUs.

In large-scale training clusters connected by NVLink Switch, the interconnect provides all-to-all GPU connectivity across multiple nodes. A compromised GPU node that has access to the NVLink Switch fabric can potentially reach GPU memory on adjacent nodes without traversing the conventional TCP/IP network.

What monitoring exists​

NVIDIA's Data Center GPU Manager (DCGM) monitors NVLink utilisation for performance and reliability purposes. It does not provide security monitoring of NVLink traffic — which GPU is communicating with which, what data is being transferred, and whether cross-tenant P2P access has been enabled.