CVE-2026-108268

Katalog CVE

CVSS 9.1 · Critical EPSS 0,13%

Kerentanan Origin Validation Error. Skor CVSS 4.0 9.1 (Critical) menurut github.com.

Deskripsi (NVD)

Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in tdx-v0.2.43 and tdx-gpu-v0.6.27.

Rincian

Terbit di NVD

9 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Received

CVSS 4.0

9.1 (Critical), sumber github.com
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error

EPSS (30 hari)

0,13% peluang dieksploitasi; lebih tinggi dari 2,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Privasys/enclave-os-virtual/commit/9a6be91e29f2b6738d0b77c33cd1ad5cd3d8a347
• https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-gpu-v0.6.27
• https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-v0.2.43
• https://github.com/Privasys/enclave-os-virtual/security/advisories/GHSA-p5fp-g94g-g9m9
• https://privasys.org/blog/binding-attestation-to-the-tls-session