Cocos AI: SEV-SNP verifier skips ReportData binding when caller passes empty expected value

Impact

Separate from the TDX path (CVE-2026-92701), the SEV-SNP verifier in Cocos AI 0.8.2 and earlier sets Policy.ReportData only when the caller supplies a non-empty expected reportData. An integration that passes nil or empty while still depending on that value for freshness gets a verifier that silently accepts SEV-SNP evidence unrelated to the current connection. The relying party then makes a trust, authorization, or data-release decision for an unintended attestation context - in practice, handing model weights or tenant data to a confidential VM it never actually attested. On GPU nodes running AMD SEV-SNP guests for multi-tenant inference or training, this removes the guarantee that keeps one tenant's workload from impersonating another's enclave.

Who can reach it

Network, no authentication: an attacker able to reach a relying party that calls the verifier with empty expected reportData, supplying any valid-looking SEV-SNP attestation report, including one captured from a different instance.

What to do

Upgrade Cocos AI to 0.9.0, which deletes the affected verifier path in favour of post-handshake attestation. Agent/relying-party upgrade and restart; no firmware or guest reprovisioning is called for in the advisory. Audit integrations for call sites that pass nil or empty expected reportData, since those are the exposed ones, and no fix is offered for the 0.8.x line.

References

Related entries

• TensorFlow (SavedModel protobuf): Mutating a SavedModel protobuf crashes or corrupts the serving processCVE-2020-15206 · TensorFlow (SavedModel protobuf)Critical
• Jupyter Server Proxy: Authentication weakness in proxied-process accessCVE-2024-28179 · Jupyter Server ProxyCritical
• vLLM (Mooncake): Unsafe deserialization over ZMQ/TCP bound to all interfacesCVE-2025-29783 · vLLM (Mooncake)Critical
• Keras (`utils.get_file`, tar extract): Path traversal on tar extractionCVE-2025-12060 · Keras (`utils.get_file`, tar extract)High
• llama.cpp (`gguf_init_from_file_impl`): Integer overflow in GGUF initCVE-2025-53630 · llama.cpp (`gguf_init_from_file_impl`)High
• Pure Storage FlashArray VASA provider: A vSphere or ESXi administrator with VASA access to a FlashArray escalates toCVE-2023-36628 · Pure Storage FlashArray VASA providerHigh