CVE-2021-1120
📋 TL;DR
This vulnerability in NVIDIA vGPU software allows a guest operating system to pass improperly terminated strings to the Virtual GPU Manager plugin. This could enable attackers with guest OS access to cause information disclosure, data tampering, code execution, or denial of service. It affects organizations using NVIDIA vGPU technology for virtualization.
💻 Affected Systems
- NVIDIA Virtual GPU Manager (vGPU plugin)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized code execution on the host system, potentially compromising the entire virtualization environment and all guest VMs.
Likely Case
Denial of service affecting vGPU functionality or information disclosure from the vGPU plugin memory.
If Mitigated
Limited impact if proper network segmentation and access controls prevent guest-to-host escalation.
🎯 Exploit Status
Exploitation requires guest OS access and knowledge of vGPU plugin internals. No public exploits known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: vGPU software version 11.4 and later
Vendor Advisory: https://nvidia.custhelp.com/app/answers/detail/a_id/5230
Restart Required: Yes
Instructions:
1. Download vGPU software version 11.4 or later from NVIDIA portal. 2. Stop all VMs using vGPU. 3. Update vGPU software on host. 4. Restart host. 5. Verify version with 'nvidia-smi -q'.
🔧 Temporary Workarounds
Isolate vGPU-enabled VMs
allSegment vGPU-enabled virtual machines onto separate networks/hosts from critical infrastructure
Restrict vGPU access
allLimit which users/VMs have vGPU capabilities to reduce attack surface
🧯 If You Can't Patch
- Implement strict network segmentation between vGPU-enabled VMs and critical systems
- Monitor vGPU plugin logs for unusual activity and implement strict access controls for guest VMs
🔍 How to Verify
Check if Vulnerable:
Check vGPU software version with 'nvidia-smi -q' and compare to affected versions (pre-11.4)Check Version:
nvidia-smi -q | grep 'Driver Version'Verify Fix Applied:
Verify version is 11.4 or later with 'nvidia-smi -q' and test vGPU functionality📡 Detection & Monitoring
Log Indicators:
- Unusual vGPU plugin errors
- Guest VM attempts to send malformed vGPU requests
- System crashes related to vGPU service
Network Indicators:
- Unusual traffic patterns from vGPU-enabled VMs to host management interfaces
SIEM Query:
source="vGPU-plugin" AND (error OR crash OR "null termination")