CVE-2020-0206: 
NixOS vulnerability analysis and mitigation

NVIDIA DGX A100 SBIOS contains a vulnerability (CVE-2020-0206) where an attacker may modify arbitrary memory of SMRAM by exploiting the NVME SMM API. The vulnerability was disclosed in March 2023 and affects DGX A100 systems with SBIOS versions prior to 1.18 (NVIDIA Security).

The vulnerability has a CVSS v3.1 base score of 7.5 with vector AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. This indicates that local access is required, attack complexity is high, and high privileges are needed. The vulnerability allows modification of arbitrary memory in the System Management RAM (SMRAM) through exploitation of the NVME SMM API (NVIDIA Security).

A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure. The high CVSS score indicates severe potential impact if successfully exploited (NVIDIA Security).

The vulnerability requires local access with high privileges and has high attack complexity, making it relatively difficult to exploit. The attacker needs to be able to exploit the NVME SMM API specifically to modify SMRAM memory (NVIDIA Security).

NVIDIA has released SBIOS version 1.18 for DGX A100 systems to address this vulnerability. Users are advised to update their systems to this version through the NVIDIA Enterprise Support Portal (NVIDIA Security).