NVIDIA DGX OS SSH Host Key Vulnerability in Factory Provisioning Process

A vulnerability exists in NVIDIA DGX OS due to the cloning of base images during the factory provisioning process, which results in identical SSH host keys being deployed across multiple systems. This uniformity in cryptographic identifiers allows for host impersonation or man-in-the-middle attacks. Exploiting this vulnerability could lead to code execution, unauthorized privilege escalation, data tampering, information disclosure, and denial-of-service conditions.

Impact

Successful exploitation could result in code execution, unauthorized privilege escalation, data tampering, information disclosure, and denial-of-service conditions.