Florian Sieck

Name of the Vulnerable Software and Affected Versions: Intel TDX Module firmware versions prior to 1.5.06 Description: The issue is related to an improper check for unusual or exceptional conditions in the Intel TDX Module firmware. This may allow a privileged user to potentially enable information disclosure via local access. The vulnerability is also described as being related to incomplete filtering of special elements, which could allow an attacker to gain unauthorized access to protected information. Recommendations: For Intel TDX Module firmware versions prior to 1.5.06, update to version 1.5.06 or later to resolve the issue. As a temporary workaround, consider restricting local access to the Intel TDX Module firmware until a patch is available.

The issue is related to the generation of the ECDSA nonce k, where a random number r is selected and then reduced modulo n, the order of the elliptic curve. The division used during the reduction estimates a factor q e by dividing the upper two digits of r by the upper digit of n and then decrements q e in a loop until it has the correct size. Observing the number of times q e is decremented through a control-flow revealing side-channel reveals a bias in the most significant bits of k. Depending on the curve, this is either a negligible bias or a significant bias large enough to reconstruct k with lattice reduction methods. For SECP160R1, a bias of 15 bits is found.

The issue concerns the AMD SEV/SEV-ES feature, where memory can be rearranged in the guest address space without being detected by the attestation mechanism. This could potentially be exploited by a malicious hypervisor to achieve arbitrary code execution within the guest VM, provided a malicious administrator has access to compromise the server hypervisor.