NVIDIA DGX Spark Out-of-Bounds Write Vulnerability in SROOT Firmware Allowing Code Execution and Privilege Escalation

A vulnerability has been identified in the SROOT firmware of NVIDIA DGX Spark GB10, where an out-of-bounds write could be exploited by an attacker. This vulnerability affects all versions prior to OTA0. A successful exploit may lead to unauthorized code execution, tampering with data, denial of service, disclosure of sensitive information, or unauthorized escalation of privileges.

Impact

Exploitation of this vulnerability could result in code execution, unauthorized access to sensitive information, unauthorized data modification, a denial-of-service condition, or an escalation of privileges.

Remediation

Users are advised to download and install the latest version of NVIDIA DGX OS from the NVIDIA DGX site.