GPUCC-VMM-META-01: The untrusted host cannot mutate the CVM/GPU launch configuration¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | NVIDIA GPU Confidential Computing |
| Lifecycle stage | deploy |
| Trust boundary | vmm |
| Assurance | operator-declared |
| Mode | Passive: reads only the files and values you pass to the scan. |
What a failure enables¶
- Model inputs and weights readable by the host
What it checks¶
It passes when:
- The launch measurement is pinned and not mutable by the untrusted host.
How to fix¶
- Pin/enforce the launch measurement and scope who can change the CVM and GPU-attach configuration to a tight human/CI admin set; never let the host/hypervisor identity redefine the launch. Prefer immutable, measured, CI-recreated deployments over in-place launch edits.
- Pin the launch measurement; scope launch changes to admins only.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No --gpu-launch-config specified; skipping check.
ERROR:
- Could not read/parse launch config: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--gpu-launch-config |
Path to the CVM/GPU launch config (JSON) for the launch-mutability check. |
Permissions¶
None. The check reads only the files or values you pass to the scan.
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).