NVIDIA vGPU Driver Vulnerability Allows Guest-to-Host Memory Leak
Overview
NVIDIA disclosed a high-severity vulnerability in its virtual GPU (vGPU) software, affecting data centers that use virtualization to share GPUs among multiple virtual machines (VMs). The flaw, located in the host kernel driver's memory mapping component, could allow a malicious actor with administrator privileges in a guest VM to read small, controlled portions of the host's physical memory. The vulnerability arises from improper input validation of memory management unit (MMU) notifications from the guest. A malicious guest could send a crafted notification that causes the host driver to incorrectly map a page of host memory as read-only into the guest's address space. While the attacker cannot choose an arbitrary address, they can repeatedly trigger the bug to scan through memory regions, potentially exfiltrating sensitive data from the host or other sibling VMs. This breaks the fundamental security boundary between guest VMs and the hypervisor host, impacting multi-tenant cloud environments that rely on vGPU for ML workloads. The issue was discovered internally by NVIDIA's security team during routine testing.
Affected Systems
Testing Guide
1. On the hypervisor host (e.g., VMware ESXi, Citrix Hypervisor), check the installed NVIDIA vGPU manager version. For ESXi, you can use the command `esxcli software vib list | grep -i nvidia`. 2. In the guest VM, check the installed driver version using the `nvidia-smi` command. 3. Compare the installed versions against the affected versions listed in the NVIDIA security bulletin.
Mitigation Steps
1. Upgrade the NVIDIA vGPU software on the hypervisor host to a patched version (15.5, 16.3, or newer). 2. Apply security updates to the guest VM drivers as recommended by NVIDIA. 3. If immediate patching is not possible, avoid placing VMs with different trust levels or tenants on the same physical host. 4. Enable IOMMU (Input-Output Memory Management Unit) features in the server's UEFI/BIOS settings for an additional layer of hardware-enforced isolation.
Patch Details
Patched in NVIDIA vGPU software versions 15.5 and 16.3. All customers are urged to update both host and guest components.