EUVD-2025-210689
GHSA-fr52-m74m-8vm9
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access and hypervisor-level privileges required (AV:L, PR:H); high complexity with prerequisites (AC:H); scope changed due to subsequent system confidentiality and integrity impact (S:C, C:H, I:L, A:N).
Primary rating from Vendor (intel).
CVSS VectorVendor: intel
Lifecycle Timeline
1DescriptionCVE.org
Insufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: Hypervisor may allow an information disclosure. A system software adversary with a privileged user access combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without any user interaction. The potential vulnerability may impact the confidentiality (high), integrity (low) and no effect on availability. Subsequent system impacts include reduced confidentiality (low), integrity (low), and no effect on availability.
AnalysisAI
Insufficient data authenticity verification within Intel Trust Domain Extensions (Intel TDX) at Ring 0 (hypervisor privilege level) enables information disclosure under a high-complexity, locally-mounted attack. A system software adversary already holding hypervisor-level privileges can exploit CWE-345 conditions to expose sensitive Trust Domain memory contents, achieving high confidentiality impact on the vulnerable system with limited integrity effects on both the vulnerable and subsequent systems. No public exploit code exists and this vulnerability has not been listed in CISA KEV, with the vendor-confirmed CVSS 4.0 score of 5.6 (Medium) accurately reflecting the constrained attack profile.
Technical ContextAI
Intel TDX is a hardware-assisted confidential computing technology that creates cryptographically isolated Trusted Domains (TDs) protecting sensitive workloads from the hypervisor, other virtual machines, and system software. It operates at Ring 0 (hypervisor privilege level) and is designed so that even a compromised hypervisor cannot read TD memory. CWE-345 (Insufficient Verification of Data Authenticity) as the root cause indicates that some data passing through the TDX module or hypervisor-TD interface fails to undergo adequate authenticity or integrity checking, which can be exploited to subvert the confidentiality guarantees TDX is specifically designed to enforce. The CPE string cpe:2.3:a:n/a:intel(r)_trust_domain_extensions_(intel(r)_tdx):*:*:*:*:*:*:*:* encompasses all versions, with exact affected software or microcode packages enumerated in Intel Security Advisory INTEL-SA-01419. The CVSS 4.0 vector explicitly calls out AT:P (attack requirements present), indicating a specific - though undisclosed - environmental or configuration prerequisite must be met.
RemediationAI
Consult Intel Security Advisory INTEL-SA-01419 at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01419.html for specific patched TDX module versions, microcode updates, or associated software package identifiers; exact fix versions are not enumerated in the data available for this analysis and should not be assumed from this report alone. Patch available per vendor advisory - apply Intel-issued TDX module or platform firmware updates as directed. Where immediate patching is not feasible, restrict Ring 0 / hypervisor administrative access to the minimum set of trusted, audited accounts, as PR:H is a hard prerequisite for exploitation - reducing the population of principals with hypervisor privilege directly narrows the attacker pool. Organizations should also review whether the specific AT:P attack prerequisites described in the advisory apply to their deployment configuration and disable or constrain relevant TDX features if guidance is issued. Monitor Intel PSIRT communications at intel.com/security-center for updates to this advisory.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today