- Reported
-
- Issued
-
- Package
-
tdx-guest
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#tdx
#tdcall
#ept
#l2-vm
- Aliases
-
- References
-
- CVSS Score
- 4.6
MEDIUM
- CVSS Details
-
- Attack Complexity
- Low
- Attack Requirements
- None
- Attack Vector
- Local
- Privileges Required
- High
- Availability Impact to the Subsequent System
- None
- Confidentiality Impact to the Subsequent System
- None
- Integrity Impact to the Subsequent System
- None
- User Interaction
- None
- Availability Impact to the Vulnerable System
- Low
- Confidentiality Impact to the Vulnerable System
- Low
- Integrity Impact to the Vulnerable System
- Low
- CVSS Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- Patched
-
- Unaffected
-
- Affected Functions
- Version
tdx_guest::tdcall::invalidate_l2_cached_ept-
Description
tdx_guest::tdcall::invalidate_l2_cached_ept() takes a bitmap that selects the
L2 VMs whose cached EPT translations should be invalidated. Bits 1 through 3
select L2 VMs 1 through 3, and all other bits are reserved. The input check
was inverted:
if l2_vm_idx_bitmap & !0b1110 == 0 {
return Err(TdCallError::TdxOperandInvalid);
}
l2_vm_idx_bitmap & !0b1110 isolates the bits that are not allowed. A result
of zero means the bitmap is valid, and the function returned an error in that
case. Every valid bitmap, such as 0b0010 or 0b1110, was therefore rejected
with TdxOperandInvalid. Bitmaps with reserved bits set, such as 0b0001 or
0b1_0000, were forwarded to the TDX module.
Intel describes the issue as an incorrect comparison and classifies it as
escalation of privilege, with a CVSS 4.0 base score of 4.6, in
INTEL-SA-01462.
The flaw was corrected in commit
311d33b,
released in 0.3.1. The function now rejects an empty bitmap and any bit
outside 0b1110.
Reported by Borys Tsyrulnikov.
Advisory available under CC0-1.0
license.