Intel TDX firmware (PRNG seeding): MULTI-TENANT ISOLATION: A predictable seed in the TDX firmware's pseudo-random

Impact

MULTI-TENANT ISOLATION: A predictable seed in the TDX firmware's pseudo-random number generator. Predictable randomness inside a confidential-compute TCB undermines whatever the module derived from it - key material, nonces, address-space randomisation inside the boundary - so the low CVSS understates the structural concern.

Who can reach it

An authenticated user on the host.

What to do

Update the Intel TDX module. The TDX module is loaded by the SEAM loader at boot, so the practical rollout is: stage the new module, drain every trust domain off the node, and reboot. It is not a live-patchable component and running TDs cannot be migrated through it. After the update, every TD must re-attest because the TDX module SVN is part of the attestation report - so anything that pinned the old measurement will fail until you update your attestation policy too. No OEM BIOS release needed for the module itself, which makes this materially faster than a platform firmware update.

References