#sroot — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #sroot, aggregated by home.social.
-
🎯 AI
===================Executive summary:
A consolidated NVIDIA security update for DGX Spark GB10 addresses a set of 14 vulnerabilities, the most severe being CVE-2025-33187 (CVSS 9.3) in the SROOT (Secure Root) component. The vendor states that this issue can allow an attacker with privileged OS access to pivot into SoC-protected areas, enabling arbitrary code execution, data tampering, and privilege persistence beyond normal OS controls.Technical details:
CVE-2025-33187 – SROOT privilege pivot (CVSS 9.3)
CVE-2025-33188 – Hardware resource tampering (CVSS 8.0)
CVE-2025-33189 – Firmware out-of-bounds write (CVSS 7.8)
CVE-2025-33191 – Memory read error
CVE-2025-33197 – NULL pointer dereferenceThe SROOT vulnerability specifically impacts the trust boundary between the host OS and System-on-Chip protected regions. The firmware and hardware resource control flaws raise the risk of data corruption, denial-of-service, and potential code execution via firmware OOB writes. Affected installations are DGX OS versions on DGX Spark GB10 prior to OTA0.
Analysis:
The worst-case scenario described involves an attacker already holding privileged OS credentials (for example, a compromised root account) leveraging SROOT to escape OS-enforced protections and access or manipulate model weights, training data, or firmware-controlled resources. Hardware resource tampering and firmware OOB writes increase the attack surface for persistent or destructive modifications that evade standard OS detection.Detection:
Monitor for anomalous access attempts to SROOT-exposed interfaces, unexpected firmware write operations, and any integrity violations of SoC-protected storage. Correlate privileged user sessions with unexplained firmware actions or hardware resource reconfigurations.Mitigation (as reported):
NVIDIA released a consolidated patch bundle; affected DGX Spark GB10 units running DGX OS prior to OTA0 are listed as vulnerable. The vendor recommends applying the OTA0 release to remediate the 14 identified issues.References:
The advisory enumerates 14 vulnerabilities; prominent IDs include CVE-2025-33187, CVE-2025-33188, and CVE-2025-33189.