Intel TDX MigTD: write-what-where condition lets privileged host software escalate privilege

Impact

MigTD has a write-what-where condition that privileged host software can use to disclose data and escalate privilege into MigTD. Intel rates confidentiality, integrity and availability impact on MigTD as high, with no impact on other systems. The record does not say which code path is affected. Under the TDX threat model the host is untrusted, so this weakens migration protections for tenant TDs.

Who can reach it

Local privileged system software on the TDX host (VMM or host root). Low complexity, no user interaction.

What to do

Apply the MigTD update named in Intel advisory INTEL-SA-01580. The record does not give a fixed version. Rollout cost depends on how your VMM stack deploys the MigTD image.

References

Related entries

• Intel TDX MigTD: replayed messages let privileged host software bypass authenticationCVE-2026-61473 · Intel TDX Migration Trust Domain (MigTD)Critical
• Intel TDX MigTD: expired pointer dereference in virtio-vsock lets privileged host software escalate privilegeCVE-2026-62929 · Intel TDX Migration Trust Domain (MigTD) - virtio-vsockHigh
• Linux kernel (drivers/infiniband/core): IWARP port-mapper netlink attributes were accepted as plain strings with noCVE-2026-63860 · Linux kernel (drivers/infiniband/core)High
• AMI MegaRAC: Password reset interception via the API — attacker takes over an admin BMC accountCVE-2022-26872 · AMI MegaRACHigh
• AMI MegaRAC: Default credentials — Redfish API accessible with shipped accountCVE-2022-40259 · AMI MegaRACHigh
• Lenovo XClarity Controller (XCC) - API privilege escalation: A read-only XCC user gains elevated privileges throughCVE-2023-0683 · Lenovo XClarity Controller (XCC) - API privilege escalationHigh