- Reported
-
- Issued
-
- Package
-
tdx_workload_attestation
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#tdx
#attestation
#gcp
#panic
- Aliases
-
- References
-
- CVSS Score
- 5.7
MEDIUM
- CVSS Details
-
- Attack Complexity
- High
- Attack Requirements
- Present
- Attack Vector
- Local
- Privileges Required
- Low
- Availability Impact to the Subsequent System
- None
- Confidentiality Impact to the Subsequent System
- None
- Integrity Impact to the Subsequent System
- None
- User Interaction
- None
- Availability Impact to the Vulnerable System
- High
- Confidentiality Impact to the Vulnerable System
- None
- Integrity Impact to the Vulnerable System
- None
- CVSS Vector
- CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Patched
-
- Affected Functions
- Version
tdx_workload_attestation::gcp::GcpTdxHost::verify_launch_endorsement-
Description
GcpTdxHost::verify_launch_endorsement(), available with the host-gcp-tdx
feature, read uefi_golden.tdx.measurements[0] without checking that the
golden measurement contains a TDX measurement. If a launch endorsement's
golden measurement had no TDX measurements, the call panicked with an index
out of bounds instead of returning an error.
The panic is reached only after the endorsement's signing certificate and
signature have been verified. Triggering it therefore requires a correctly
signed endorsement that lacks TDX measurements.
Intel describes the issue as improper input validation and classifies it as
denial of service, with a CVSS 4.0 base score of 5.7, in INTEL-SA-01520.
The flaw was corrected in
#87, released
in 0.2.0. The function now returns Error::ParseError when the TDX
measurement structure is missing or empty.
Reported by Borys Tsyrulnikov.
Advisory available under CC0-1.0
license.