{"id":"CVE-2026-20763","aliases":["EUVD-2026-56490","GHSA-wgvc-hf5h-m5h7","RUSTSEC-2026-0485"],"status":"published","title":"Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3:...","description":"Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","severity":{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00149,"percentile":0.04178,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-682"],"published":"2026-08-11T12:00:00Z","modified":"2026-11-11T08:45:02Z","fixes":[{"ecosystem":"crates.io","package":"tdx-guest","fixed_in":["0.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"tdx-guest","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.8"},{"fixed":"0.3.1"}]}]}],"products":[{"vendor":"intel","product":"trust_domain_extensions_guest"}],"references":[{"url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01462.html","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20763"},{"url":"https://github.com/advisories/GHSA-wgvc-hf5h-m5h7"},{"url":"https://crates.io/crates/tdx-guest","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0485.html","tags":["advisory"]},{"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01462.html","tags":["web"]},{"url":"https://github.com/intel/confidential-computing.tdx.tdx-guest/commit/311d33b18a5bef5dc67c9b0c86587dd00c77027e","tags":["web"]},{"url":"https://borystsyrulnikov.dev/posts/tdx-guest-l2-vm-bugs/","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-20763","description":"Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","status":"published","published":"2026-08-11T16:26:01.998Z","modified":"2026-08-12T15:46:24.853Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-682","CWE-682"],"updated_at":"2026-11-02T13:35:44.571002Z"}],"euvd":[{"id":"EUVD-2026-56490","description":"Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","status":"published","published":"2026-08-11T16:26:01Z","modified":"2026-08-12T15:46:24Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:58.302106Z"}],"ghsa":[{"id":"GHSA-wgvc-hf5h-m5h7","title":"Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3:...","description":"Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","status":"published","published":"2026-08-11T18:30:52Z","modified":"2026-08-18T18:32:51Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T15:10:37.069016Z"}],"nvd":[{"id":"CVE-2026-20763","description":"Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","status":"published","published":"2026-08-11T17:17:51.827Z","modified":"2026-08-18T15:48:13.78Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T14:12:36.499002Z"}],"osv":[{"id":"RUSTSEC-2026-0485","title":"`enter_l2_vcpu` passes the wrong RCX operand to `TDG.VP.ENTER`","description":"`tdx_guest::tdcall::enter_l2_vcpu()` invokes the `TDG.VP.ENTER` TDCALL. RCX\nmust carry the L2 VM index in bits 53:52 and the invalidation control value\n(`InvdTranslations`, 0 to 3) in bits 1:0. The function computed that value as\n`(l2_vm_idx \u003c\u003c 52) | (invd_translations as u64)`, but then passed the raw\n`l2_vm_idx` in RCX instead.\n\nAs a result, the TDX module received an operand that differs from the\ncaller's request. The VM index field was 0, and the low bits of the index\nwere interpreted as the invalidation control value. For example, VM 1 with\n`InvdTlb` (2) should produce `0x0010_0000_0000_0002`, but produced `0x1`.\n\nIntel describes the issue as an incorrect calculation and classifies it as\nescalation of privilege, with a CVSS 4.0 base score of 4.6, in\nINTEL-SA-01462.\n\nThe flaw was corrected in commit\n[`311d33b`](https://github.com/intel/confidential-computing.tdx.tdx-guest/commit/311d33b18a5bef5dc67c9b0c86587dd00c77027e),\nreleased in 0.3.1, which passes the computed RCX value.\n\nReported by [Borys Tsyrulnikov](https://borystsyrulnikov.dev).","status":"published","published":"2026-08-11T12:00:00Z","modified":"2026-11-11T08:45:02.456713599Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-11T08:57:35.149852Z"}]}}