{"id":"RUSTSEC-2026-0480","summary":"Panic on a GCP launch endorsement without TDX measurements","details":"`GcpTdxHost::verify_launch_endorsement()`, available with the `host-gcp-tdx`\nfeature, read `uefi_golden.tdx.measurements[0]` without checking that the\ngolden measurement contains a TDX measurement. If a launch endorsement's\ngolden measurement had no TDX measurements, the call panicked with an index\nout of bounds instead of returning an error.\n\nThe panic is reached only after the endorsement's signing certificate and\nsignature have been verified. Triggering it therefore requires a correctly\nsigned endorsement that lacks TDX measurements.\n\nIntel describes the issue as improper input validation and classifies it as\ndenial of service, with a CVSS 4.0 base score of 5.7, in INTEL-SA-01520.\n\nThe flaw was corrected in\n[#87](https://github.com/IntelLabs/tdx-workload-attestation/pull/87), released\nin 0.2.0. The function now returns `Error::ParseError` when the TDX\nmeasurement structure is missing or empty.\n\nReported by [Borys Tsyrulnikov](https://borystsyrulnikov.dev).","aliases":["CVE-2026-40693","GHSA-gwf2-8595-qw97"],"modified":"2026-11-11T08:45:02.464645086Z","published":"2026-11-10T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/tdx_workload_attestation"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0480.html"},{"type":"WEB","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01520.html"},{"type":"WEB","url":"https://github.com/IntelLabs/tdx-workload-attestation/pull/87"},{"type":"WEB","url":"https://github.com/IntelLabs/tdx-workload-attestation/releases/tag/v0.2.0"}],"affected":[{"package":{"name":"tdx_workload_attestation","ecosystem":"crates.io","purl":"pkg:cargo/tdx_workload_attestation"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.0"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":["tdx_workload_attestation::gcp::GcpTdxHost::verify_launch_endorsement"],"arch":[]},"affected_functions":null},"database_specific":{"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0480.json","categories":["denial-of-service"],"cvss":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}