zenodo.org
A Canary in the Crypto Mine: Defeating Stack Protection in a GPU Secure Coprocessor
A widely sold datacenter-class accelerator (the NVIDIA “CMP 170HX”) is the same die as a flagship A100 but is fuse-crippled on three commercial axes: SM math rate (throttled to 1/32), memory capacity (10 GB instead of 80 GB), and PCIe link (Gen1 instead of Gen4). We show that all three caps are software-defeatable from a rooted-but-otherwise-unprivileged host, with no signing key, no debug fuse, and no physical access. The root enabler is arbitrary code execution in the GPU’s Heavy Secure (HS) Falcon mode. The HS break does not depend on the value of the stack canary: the stack-protector’s reference word lives in writable memory reachable by the same data overflow it is meant to detect, so secrecy and entropy are irrelevant. Because the microcode is deterministic, we emulate it offline and author an overflow payload that is a valid continuation image, so the victim function passes its own canary check and returns into our chain. The economic consequence is that differentiation the business model treats as hardware-permanent is, for the three axes we defeated, only firmware-gated. Three further axes (PCIe Gen3, on-die ECC, runtime HBM retiming) resisted our attempts; we report this without claiming they are truly unbreakable, since we do not fully understand the relevant fuses or initialization. The HS code-execution bug is a regression present in the newer open-kernel-modules-era booter and absent in an older one, so version currency is not a security gradient, and an open host driver did not imply an audited signed booter. Measured gains: roughly 31–62x compute, 8x capacity, 2x link. We distill four transferable findings.
