EUVD-2025-210689
GHSA-fr52-m74m-8vm9
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access and hypervisor-level privileges required (AV:L, PR:H); high complexity with prerequisites (AC:H); scope changed due to subsequent system confidentiality and integrity impact (S:C, C:H, I:L, A:N).
Primary rating from Vendor (intel).
CVSS VectorVendor: intel
Lifecycle Timeline
1DescriptionCVE.org
Insufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: Hypervisor may allow an information disclosure. A system software adversary with a privileged user access combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without any user interaction. The potential vulnerability may impact the confidentiality (high), integrity (low) and no effect on availability. Subsequent system impacts include reduced confidentiality (low), integrity (low), and no effect on availability.
AnalysisAI
Insufficient data authenticity verification within Intel Trust Domain Extensions (Intel TDX) at Ring 0 (hypervisor privilege level) enables information disclosure under a high-complexity, locally-mounted attack. A system software adversary already holding hypervisor-level privileges can exploit CWE-345 conditions to expose sensitive Trust Domain memory contents, achieving high confidentiality impact on the vulnerable system with limited integrity effects on both the vulnerable and subsequent systems. No public exploit code exists and this vulnerability has not been listed in CISA KEV, with the vendor-confirmed CVSS 4.0 score of 5.6 (Medium) accurately reflecting the constrained attack profile.
Technical ContextAI
Intel TDX is a hardware-assisted confidential computing technology that creates cryptographically isolated Trusted Domains (TDs) protecting sensitive workloads from the hypervisor, other virtual machines, and system software. It operates at Ring 0 (hypervisor privilege level) and is designed so that even a compromised hypervisor cannot read TD memory. CWE-345 (Insufficient Verification of Data Authenticity) as the root cause indicates that some data passing through the TDX module or hypervisor-TD interface fails to undergo adequate authenticity or integrity checking, which can be exploited to subvert the confidentiality guarantees TDX is specifically designed to enforce. The CPE string cpe:2.3:a:n/a:intel(r)_trust_domain_extensions_(intel(r)_tdx):*:*:*:*:*:*:*:* encompasses all versions, with exact affected software or microcode packages enumerated in Intel Security Advisory INTEL-SA-01419. The CVSS 4.0 vector explicitly calls out AT:P (attack requirements present), indicating a specific - though undisclosed - environmental or configuration prerequisite must be met.
RemediationAI
Consult Intel Security Advisory INTEL-SA-01419 at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01419.html for specific patched TDX module versions, microcode updates, or associated software package identifiers; exact fix versions are not enumerated in the data available for this analysis and should not be assumed from this report alone. Patch available per vendor advisory - apply Intel-issued TDX module or platform firmware updates as directed. Where immediate patching is not feasible, restrict Ring 0 / hypervisor administrative access to the minimum set of trusted, audited accounts, as PR:H is a hard prerequisite for exploitation - reducing the population of principals with hypervisor privilege directly narrows the attacker pool. Organizations should also review whether the specific AT:P attack prerequisites described in the advisory apply to their deployment configuration and disable or constrain relevant TDX features if guidance is issued. Monitor Intel PSIRT communications at intel.com/security-center for updates to this advisory.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today