{"id":"RUSTSEC-2026-0484","summary":"Inverted bitmap validation in `invalidate_l2_cached_ept`","details":"`tdx_guest::tdcall::invalidate_l2_cached_ept()` takes a bitmap that selects the\nL2 VMs whose cached EPT translations should be invalidated. Bits 1 through 3\nselect L2 VMs 1 through 3, and all other bits are reserved. The input check\nwas inverted:\n\n    if l2_vm_idx_bitmap & !0b1110 == 0 {\n        return Err(TdCallError::TdxOperandInvalid);\n    }\n\n`l2_vm_idx_bitmap & !0b1110` isolates the bits that are not allowed. A result\nof zero means the bitmap is valid, and the function returned an error in that\ncase. Every valid bitmap, such as `0b0010` or `0b1110`, was therefore rejected\nwith `TdxOperandInvalid`. Bitmaps with reserved bits set, such as `0b0001` or\n`0b1_0000`, were forwarded to the TDX module.\n\nIntel describes the issue as an incorrect comparison and classifies it as\nescalation of privilege, with a CVSS 4.0 base score of 4.6, in\nINTEL-SA-01462.\n\nThe flaw was corrected in commit\n[`311d33b`](https://github.com/intel/confidential-computing.tdx.tdx-guest/commit/311d33b18a5bef5dc67c9b0c86587dd00c77027e),\nreleased in 0.3.1. The function now rejects an empty bitmap and any bit\noutside `0b1110`.\n\nReported by [Borys Tsyrulnikov](https://borystsyrulnikov.dev).","aliases":["CVE-2026-20765","GHSA-56j3-r4r2-x3x6"],"modified":"2026-11-11T08:45:02.464648743Z","published":"2026-08-11T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/tdx-guest"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0484.html"},{"type":"WEB","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01462.html"},{"type":"WEB","url":"https://github.com/intel/confidential-computing.tdx.tdx-guest/commit/311d33b18a5bef5dc67c9b0c86587dd00c77027e"},{"type":"WEB","url":"https://borystsyrulnikov.dev/posts/tdx-guest-l2-vm-bugs/"}],"affected":[{"package":{"name":"tdx-guest","ecosystem":"crates.io","purl":"pkg:cargo/tdx-guest"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.8"},{"fixed":"0.3.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"functions":["tdx_guest::tdcall::invalidate_l2_cached_ept"],"arch":[],"os":[]}},"database_specific":{"categories":["privilege-escalation"],"cvss":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0484.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}