{"id":160597,"date":"2026-02-11T17:11:57","date_gmt":"2026-02-11T15:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-pozvolyayushhaya-obojti-mehanizm-zashhity-intel-tdx"},"modified":"2026-02-11T17:11:57","modified_gmt":"2026-02-11T15:11:57","slug":"uyazvimost-pozvolyayushhaya-obojti-mehanizm-zashhity-intel-tdx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-pozvolyayushhaya-obojti-mehanizm-zashhity-intel-tdx","title":{"rendered":"Vulnerability Allowing Bypass of Intel TDX Protection Mechanism","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Google and Intel have disclosed the results (PDF) of their collaborative security audit of Intel TDX 1.5 (Trusted Domain Extensions). The Intel TDX technology enables memory encryption for virtual machines, protecting them from interference and analysis by the host system administrator and physical attacks on hardware. The audit revealed 6 vulnerabilities and 35 non-security-related bugs. <\/p>\n

The issues affect Intel Xeon 6 CPUs, as well as 4th and 5th generation Intel Xeon Scalable processors. The vulnerabilities were addressed in yesterday's microcode update. A toolkit for exploiting vulnerabilities in Intel TDX and prototypes of exploits for two vulnerabilities (CVE-2025-30513, CVE-2025-32007) have been published on GitHub. <\/p>\n

The most critical vulnerability (CVE-2025-30513) allows an untrusted administrator with access to the host system to elevate their privileges and fully compromise the security guarantees provided by Intel TDX technology. The vulnerability is caused by a race condition in one of the TDX modules, which permits the transition of a protected environment (TD \u2014 Trusted Domain) from a migration-supporting state to a debug mode-allowing state during virtual machine migration. <\/p>\n

The issue is caused by the ability to substitute environment attributes right after their validation but before they are set to an immutable state in the migrated environment. After the debug attribute is set, the host system administrator can monitor the activity of the protected guest system in real time and access the decrypted state of memory. <\/p>\n

The vulnerability is relatively easy to exploit, as the administrator can initiate the live migration process of a protected virtual machine at any time. The issue was identified by researchers at Google, who noted discrepancies in how the FSM (Finite State Machine) tracks the state of operations, handles the interruption of the import operation, and changes without reverting to its original state after a failure in the protected environment. <\/p>\n

Less critical vulnerabilities: <\/p>\n