Intel TDX module: The TDX module is the software that stands between the host/VMM and every confidential VM on the box

CVSS 4.1CVE-2025-20044Firmware, BMC & network fabriccurated

Impact

The TDX module is the software that stands between the host/VMM and every confidential VM on the box; a privilege escalation inside it is a break of the boundary that separates a tenant's trust domain from the operator and from other TDs. Specific flaw: improper locking, letting a privileged host user escalate.

Who can reach it

A privileged user on the host - which in the TDX threat model is the adversary the whole design exists to exclude, so 'requires host privilege' is not a mitigating factor here.

What to do

Update the Intel TDX module. The TDX module is loaded by the SEAM loader at boot, so the practical rollout is: stage the new module, drain every trust domain off the node, and reboot. It is not a live-patchable component and running TDs cannot be migrated through it. After the update, every TD must re-attest because the TDX module SVN is part of the attestation report - so anything that pinned the old measurement will fail until you update your attestation policy too. No OEM BIOS release needed for the module itself, which makes this materially faster than a platform firmware update.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-20044 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01245.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.