{"id":"RUSTSEC-2026-0485","summary":"`enter_l2_vcpu` passes the wrong RCX operand to `TDG.VP.ENTER`","details":"`tdx_guest::tdcall::enter_l2_vcpu()` invokes the `TDG.VP.ENTER` TDCALL. RCX\nmust carry the L2 VM index in bits 53:52 and the invalidation control value\n(`InvdTranslations`, 0 to 3) in bits 1:0. The function computed that value as\n`(l2_vm_idx \u003c\u003c 52) | (invd_translations as u64)`, but then passed the raw\n`l2_vm_idx` in RCX instead.\n\nAs a result, the TDX module received an operand that differs from the\ncaller's request. The VM index field was 0, and the low bits of the index\nwere interpreted as the invalidation control value. For example, VM 1 with\n`InvdTlb` (2) should produce `0x0010_0000_0000_0002`, but produced `0x1`.\n\nIntel describes the issue as an incorrect calculation and classifies it as\nescalation of privilege, with a CVSS 4.0 base score of 4.6, in\nINTEL-SA-01462.\n\nThe flaw was corrected in commit\n[`311d33b`](https://github.com/intel/confidential-computing.tdx.tdx-guest/commit/311d33b18a5bef5dc67c9b0c86587dd00c77027e),\nreleased in 0.3.1, which passes the computed RCX value.\n\nReported by [Borys Tsyrulnikov](https://borystsyrulnikov.dev).","aliases":["CVE-2026-20763","GHSA-wgvc-hf5h-m5h7"],"modified":"2026-11-11T08:45:02.456713599Z","published":"2026-08-11T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/tdx-guest"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0485.html"},{"type":"WEB","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01462.html"},{"type":"WEB","url":"https://github.com/intel/confidential-computing.tdx.tdx-guest/commit/311d33b18a5bef5dc67c9b0c86587dd00c77027e"},{"type":"WEB","url":"https://borystsyrulnikov.dev/posts/tdx-guest-l2-vm-bugs/"}],"affected":[{"package":{"name":"tdx-guest","ecosystem":"crates.io","purl":"pkg:cargo/tdx-guest"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.8"},{"fixed":"0.3.1"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":["tdx_guest::tdcall::enter_l2_vcpu"],"arch":[]},"affected_functions":null},"database_specific":{"cvss":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0485.json","informational":null,"categories":["privilege-escalation"]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}