Skip to main content

Intel Xeon TDX CVE-2025-31938

| EUVDEUVD-2025-210691 MEDIUM
Insufficient Granularity of Access Control (CWE-1220)
2026-08-11 intel GHSA-c68w-56q5-h83x
Information Disclosure Intel N A Suse Intel R Xeon R 6 Scalable Processors With Intel R Tdx May Allow An Information Disclosure Authorized Adversary With An Authenticated User Combined With A High Complexity Attack May Enable Data Exposure This Result May Potentially Occur Via Local Access When Attack Requirements Are Present With Special Internal Knowledge And Requires No User Interaction The Potential Vulnerability May Impact The Confidentiality None Integrity None And Availability None Of The Vulnerable System Resulting In Subsequent System Confidentiality High Integrity None And Availability None Impacts
4.3
CVSS 4.0 · Vendor: intel
Share

Severity by source

Vendor (intel) PRIMARY
4.3 MEDIUM
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.6 MEDIUM

Local-only access, high complexity with special processor knowledge required, low-privilege auth needed; scope changes across trust domain boundary yielding high confidentiality impact on subsequent system only.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
SUSE
5.6 HIGH
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from Vendor (intel).

CVSS VectorVendor: intel

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 11, 2026 - 22:00 vuln.today

DescriptionCVE.org

Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6 Scalable processors with Intel(R) TDX may allow an information disclosure. Authorized adversary with an authenticated user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.

AnalysisAI

Insufficient access control granularity in a subsystem of Intel Xeon 6 Scalable processors with Trust Domain Extensions (TDX) enables cross-domain information disclosure. The flaw, classified under CWE-1220, allows an authenticated local adversary with specialized knowledge of processor internals to leak confidential data belonging to a co-resident trust domain or protected virtual machine, while leaving integrity and availability of all systems untouched. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 4.0 scope-change pattern (VC:N/SC:H) signals a meaningful cross-trust-domain confidentiality risk specifically in confidential computing deployments.

Technical ContextAI

Intel Trust Domain Extensions (TDX) is a hardware-assisted confidential computing feature introduced in Intel Xeon 6 Scalable processors that creates cryptographically isolated virtual machines called Trust Domains (TDs), designed to protect tenant workloads from the hypervisor, host OS, and co-tenants. CWE-1220 (Insufficient Granularity of Access Control) indicates that an internal processor subsystem - likely a memory controller, cache, or TD management unit - does not enforce isolation at a sufficiently fine-grained level, potentially allowing one context to observe state belonging to a separate TD. The CVSS 4.0 vector's VC:N/VI:N/VA:N alongside SC:H/SI:N/SA:N confirms the exploit does not directly compromise the host or attacker's own context but instead exposes confidential data from a separate protected environment across the security boundary. The AT:P designator (attack requirements present) aligns with the description's requirement for 'special internal knowledge' of processor internals, placing this beyond a generic exploitation profile.

RemediationAI

Administrators should consult Intel Security Advisory INTEL-SA-01404 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01404.html) for microcode or firmware updates addressing this issue. Intel typically delivers processor-level mitigations via BIOS/UEFI firmware updates containing updated microcode; coordinate with the platform or server vendor (Dell, HPE, Lenovo, Supermicro, etc.) for the applicable firmware revision applicable to your hardware model. Exact patched microcode versions are not independently confirmed from the available input data - the advisory is the authoritative source. As an interim compensating control, organizations with a low tolerance for cross-domain confidentiality risk may consider disabling TDX in BIOS/UEFI settings until a validated firmware update is applied, accepting the trade-off of losing confidential computing isolation for hosted trust domain workloads. Restricting physical and privileged logical access to affected servers also limits exposure given the authenticated local attacker model required by this vulnerability.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-1220 – Insufficient Granularity of Access Control

View all
CVE-2026-33825 HIGH POC
7.8
CVE-2025-31201 CRITICAL POC
9.8
CVE-2026-56155 HIGH POC
7.8
CVE-2024-5389 HIGH POC
8.1
CVE-2024-8927 HIGH POC
7.5
CVE-2024-4147 MEDIUM POC
6.5
CVE-2024-6867 MEDIUM POC
6.5
CVE-2024-29200 MEDIUM POC
6.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

CVE-2025-31938 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy