RUSTSEC-2026-0484

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0484

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0484.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0484

Aliases

CVE-2026-20765
GHSA-56j3-r4r2-x3x6

Published

2026-08-11T12:00:00Z

Modified

2026-11-11T08:45:02Z

Severity

4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Inverted bitmap validation in `invalidate_l2_cached_ept`

Details

tdx_guest::tdcall::invalidate_l2_cached_ept() takes a bitmap that selects the L2 VMs whose cached EPT translations should be invalidated. Bits 1 through 3 select L2 VMs 1 through 3, and all other bits are reserved. The input check was inverted:

if l2_vm_idx_bitmap & !0b1110 == 0 {
    return Err(TdCallError::TdxOperandInvalid);
}

l2_vm_idx_bitmap & !0b1110 isolates the bits that are not allowed. A result of zero means the bitmap is valid, and the function returned an error in that case. Every valid bitmap, such as 0b0010 or 0b1110, was therefore rejected with TdxOperandInvalid. Bitmaps with reserved bits set, such as 0b0001 or 0b1_0000, were forwarded to the TDX module.

Intel describes the issue as an incorrect comparison and classifies it as escalation of privilege, with a CVSS 4.0 base score of 4.6, in INTEL-SA-01462.

The flaw was corrected in commit 311d33b, released in 0.3.1. The function now rejects an empty bitmap and any bit outside 0b1110.

Reported by Borys Tsyrulnikov.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / tdx-guest

Package

Name: tdx-guest; View open source insights on deps.dev
Purl: pkg:cargo/tdx-guest

Affected ranges

Type: SEMVER
Events: Introduced

0.1.8

Fixed

0.3.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "tdx_guest::tdcall::invalidate_l2_cached_ept"
        ],
        "os": []
    }
}