NVIDIA Base Command Manager 인증 누락 취약점 (CVE-2024-0138)

1. NVIDIA Base Command Manager (NVIDIA BCM) [1]

- AI(인공지능)와 HPC(High Performance Computing, 고성능 컴퓨팅)을 위한 클러스터 관리 소프트웨어
- 멀티 클라우드 및 온프레미스 환경 지원

※ 클러스터(Cluster) : 여러 대의 컴퓨터가 서로 연결되어 하나의 시스템처럼 작동하도록 구성한 컴퓨팅 환경

 

2. CVE-2024-0138

[사진 1] CVE-2024-0138 [2]

- NVIDIA BCM 구성요소인 CMDaemon의 인증 누락 취약점 (CVSS : 9.8)
> CMDaemon : CPU나 네트워크 등 클러스터의 구성요소 간 통신을 지원하고, 작업이 원활하게 실행되도록 돕는 프로세스 [3]
> 익스플로잇에 성공할 경우 코드 실행, 서비스 거부, 권한 상승, 정보 유출, 데이터 변조가 가능

영향받는버전
NVIDIA Base Command Manager 10.24.09

 

- 누구나 인증 없이 시스템에 접근할 수 있는 취약점으로 신속한 업데이트 권고 [4][5]

제품명	영향받는 버전	해결 버전
NVIDIA Base Command Manager	10.24.09	10.24.09a

3. 참고

[1] https://docs.nvidia.com/base-command-manager/index.html
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-0138
[3] https://docs.nvidia.com/dgx-superpod/administration-guide-dgx-superpod/latest/cluster-management-daemon.html#cluster-management-daemon
[4] https://www.boho.or.kr/kr/bbs/view.do?bbsId=B0000133&pageIndex=1&nttId=71594&menuNo=205020
[5] https://nvidia.custhelp.com/app/answers/detail/a_id/5595
[6] https://github.com/advisories/GHSA-626w-372f-948x
[7] https://www.boannews.com/media/view.asp?idx=134648&page=1&kind=1