- Reported
-
- Issued
-
- Package
-
tdx-guest
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#tdx
#tdcall
#l2-vm
#confidential-computing
- Aliases
-
- References
-
- CVSS Score
- 4.6
MEDIUM
- CVSS Details
-
- Attack Complexity
- Low
- Attack Requirements
- None
- Attack Vector
- Local
- Privileges Required
- High
- Availability Impact to the Subsequent System
- None
- Confidentiality Impact to the Subsequent System
- None
- Integrity Impact to the Subsequent System
- None
- User Interaction
- None
- Availability Impact to the Vulnerable System
- Low
- Confidentiality Impact to the Vulnerable System
- Low
- Integrity Impact to the Vulnerable System
- Low
- CVSS Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- Patched
-
- Unaffected
-
- Affected Functions
- Version
tdx_guest::tdcall::enter_l2_vcpu-
Description
tdx_guest::tdcall::enter_l2_vcpu() invokes the TDG.VP.ENTER TDCALL. RCX
must carry the L2 VM index in bits 53:52 and the invalidation control value
(InvdTranslations, 0 to 3) in bits 1:0. The function computed that value as
(l2_vm_idx << 52) | (invd_translations as u64), but then passed the raw
l2_vm_idx in RCX instead.
As a result, the TDX module received an operand that differs from the
caller's request. The VM index field was 0, and the low bits of the index
were interpreted as the invalidation control value. For example, VM 1 with
InvdTlb (2) should produce 0x0010_0000_0000_0002, but produced 0x1.
Intel describes the issue as an incorrect calculation and classifies it as
escalation of privilege, with a CVSS 4.0 base score of 4.6, in
INTEL-SA-01462.
The flaw was corrected in commit
311d33b,
released in 0.3.1, which passes the computed RCX value.
Reported by Borys Tsyrulnikov.
Advisory available under CC0-1.0
license.