Executive brief
NVIDIA ConnectX and BlueField networking adapters contain a security vulnerability in their command interface. These devices are high-performance network controllers and Data Processing Units (DPUs) used in data centers and cloud environments. A local user with access to a virtual function could exploit this flaw to execute unauthorized code on the device, potentially compromising the integrity of the network hardware and the data it processes.
Technical details
This vulnerability is classified as an out-of-bounds write (CWE-787) within the command interface of NVIDIA ConnectX and BlueField firmware. An attacker with local access and Virtual Function (VF) permissions can trigger the flaw by providing specially crafted input to the device's command interface. The vulnerability allows for a write beyond the intended buffer boundaries, which can be leveraged to achieve arbitrary code execution on the hardware. The exploit has a high impact on confidentiality, integrity, and availability, and notably involves a scope jump (CVSS S:C), indicating the compromise can extend beyond the immediate security scope of the virtual function. Patches have been released in various firmware branches, including versions 46.3008, 35.8002, 39.8002, and 43.8002.
Affected products
- NVIDIA BlueField GA (BlueField-2, BlueField-3) All versions prior to 46.3008
- NVIDIA BlueField LTS22 (BlueField-2) All versions prior to 35.8002
- NVIDIA BlueField LTS23 (BlueField-2, BlueField-3) All versions prior to 39.8002
- NVIDIA BlueField LTS24 (BlueField-2, BlueField-3) All versions prior to 43.8002
- NVIDIA ConnectX GA (ConnectX-6, ConnectX-7, ConnectX-8) All versions prior to 46.3008
- NVIDIA ConnectX LTS22 (ConnectX-5, ConnectX-6, ConnectX-7) All versions prior to 35.8002
- NVIDIA ConnectX LTS23 (ConnectX-6, ConnectX-7) All versions prior to 39.8002
- NVIDIA ConnectX LTS24 (ConnectX-6, ConnectX-7) All versions prior to 43.8002
Timeline
- 2026-07-01: advisory: NVIDIA published the security bulletin.