Cocos AI: TDX aTLS verifier ignores expected REPORT_DATA, accepting replayed attestation evidence

Impact

Cocos AI is used to run AI workloads inside confidential VMs, so the attestation check is the only thing proving that the enclave a relying party is about to hand a model or dataset to is the one it thinks it is. In 0.8.2 and earlier the TDX verifier receives the expected current-session value but never applies it to TdQuoteBodyPolicy.ReportData, so a structurally valid TDX QuoteV4 with mismatched or reused REPORT_DATA passes. An attacker who can present previously captured evidence - or evidence from an unrelated TEE instance - can get the relying party to release application data or grant authorization for an attestation context that is not the current TLS session. On a shared confidential-AI fleet this collapses the tenant separation the TEE was bought for: model weights and input data can be released to a session that was never actually attested.

Who can reach it

Network, no authentication: anyone who can complete the aTLS handshake with a relying party that uses this verifier, holding any structurally valid TDX quote (including a replayed one).

What to do

Upgrade Cocos AI to 0.9.0, which removes the affected verifier path as part of the move to post-handshake attestation. This is a control-plane/agent upgrade plus a service restart on the relying-party side; the TDX guests themselves do not need reprovisioning, but any trust decision made by an 0.8.2-or-earlier relying party should be treated as unverified. The advisory names no backport to the 0.8.x line.

References

Related entries

• Cocos AI: SEV-SNP verifier skips ReportData binding when caller passes empty expected valueCVE-2026-92702 · Cocos AI (AMD SEV-SNP attestation verifier, VerifyAttestationReportTLS)Critical
• TensorFlow (SavedModel protobuf): Mutating a SavedModel protobuf crashes or corrupts the serving processCVE-2020-15206 · TensorFlow (SavedModel protobuf)Critical
• Jupyter Server Proxy: Authentication weakness in proxied-process accessCVE-2024-28179 · Jupyter Server ProxyCritical
• vLLM (Mooncake): Unsafe deserialization over ZMQ/TCP bound to all interfacesCVE-2025-29783 · vLLM (Mooncake)Critical
• Keras (`utils.get_file`, tar extract): Path traversal on tar extractionCVE-2025-12060 · Keras (`utils.get_file`, tar extract)High
• llama.cpp (`gguf_init_from_file_impl`): Integer overflow in GGUF initCVE-2025-53630 · llama.cpp (`gguf_init_from_file_impl`)High