CVE-2021-34398
📋 TL;DR
This vulnerability allows any user on a system with NVIDIA DCGM to inject malicious shared libraries into the DCGM server process, which typically runs with root privileges. This can lead to complete system compromise through privilege escalation, data theft, and denial of service. All users running NVIDIA DCGM versions prior to 2.2.9 are affected.
💻 Affected Systems
- NVIDIA Data Center GPU Manager (DCGM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full root compromise of the host system, allowing attacker to steal all data, install persistent backdoors, and completely disrupt operations.
Likely Case
Privilege escalation from any user account to root, leading to complete system control and potential lateral movement in the environment.
If Mitigated
Limited impact if DCGM server runs with reduced privileges or is isolated from critical systems.
🎯 Exploit Status
Exploitation requires local user access but is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.9 and later
Vendor Advisory: https://nvidia.custhelp.com/app/answers/detail/a_id/5219
Restart Required: Yes
Instructions:
1. Download NVIDIA DCGM version 2.2.9 or later from NVIDIA's website. 2. Stop the DCGM service. 3. Install the updated package. 4. Restart the DCGM service.
🔧 Temporary Workarounds
Run DCGM with reduced privileges
linuxConfigure DCGM to run as a non-root user to limit impact of exploitation
sudo systemctl edit nvidia-dcgm
Add: User=nonrootuser
sudo systemctl daemon-reload
sudo systemctl restart nvidia-dcgm
Restrict access to DCGM service
linuxLimit which users can interact with the DCGM service using access controls
sudo chmod 750 /usr/bin/nv-hostengine
sudo setfacl -m u:alloweduser:rx /usr/bin/nv-hostengine
🧯 If You Can't Patch
- Isolate affected systems from critical infrastructure and implement strict network segmentation
- Implement strict user access controls and monitor for suspicious privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check DCGM version: dcgmi --version | grep VersionCheck Version:
dcgmi --versionVerify Fix Applied:
Verify version is 2.2.9 or higher: dcgmi --version📡 Detection & Monitoring
Log Indicators:
- Unusual library loading in DCGM process logs
- Sudden privilege escalation from non-root to root users
- Unexpected process execution by DCGM service
Network Indicators:
- Unusual outbound connections from DCGM server
- Lateral movement attempts from DCGM host
SIEM Query:
process_name="nv-hostengine" AND (event_type="library_load" OR parent_process!="root")