PT-2026-141837
CVE-2026-40693
·
Published
2026-11-10
·
Updated
2026-11-10
Description by
CVSS 4.0
5.7
MediumMetricsAV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Intel(R) TDX Workload Attestation versions prior to 0.2.0
Description
Improper input validation in the
GcpTdxHost::verify launch endorsement() function, available with the host-gcp-tdx feature, allows a denial of service. The issue occurs when the function reads uefi golden.tdx.measurements[0] without verifying that the golden measurement contains a TDX measurement. If a launch endorsement lacks TDX measurements, the system triggers a panic due to an index out of bounds instead of returning an error. This can be exploited by an authenticated, unprivileged local adversary using a high complexity attack that requires a correctly signed endorsement lacking TDX measurements, resulting in high impact on system availability.Recommendations
Update to version 0.2.0.
Found an issue in the description? Have something to add? Feel free to write us 👾