Intel TDX module firmware: Missing check for an exceptional condition in the TDX module allows a privileged user

CVSS 2.5CVE-2024-27457Firmware, BMC & network fabriccurated

Impact

Missing check for an exceptional condition in the TDX module allows a privileged user to reach information disclosure. Scored very low, but it is inside the TDX TCB, so it still triggers a module SVN bump and therefore a re-attestation cycle.

Who can reach it

Privileged host user.

What to do

Update the Intel TDX module. The TDX module is loaded by the SEAM loader at boot, so the practical rollout is: stage the new module, drain every trust domain off the node, and reboot. It is not a live-patchable component and running TDs cannot be migrated through it. After the update, every TD must re-attest because the TDX module SVN is part of the attestation report - so anything that pinned the old measurement will fail until you update your attestation policy too. No OEM BIOS release needed for the module itself, which makes this materially faster than a platform firmware update.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-27457 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01099.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.