Vulnerability RUSTSEC-2026-0484

tdx_guest::tdcall::invalidate_l2_cached_ept() takes a bitmap that selects the L2 VMs whose cached EPT translations should be invalidated. Bits 1 through 3 select L2 VMs 1 through 3, and all other bits are reserved. The input check was inverted:

if l2_vm_idx_bitmap & !0b1110 == 0 {
    return Err(TdCallError::TdxOperandInvalid);
}

l2_vm_idx_bitmap & !0b1110 isolates the bits that are not allowed. A result of zero means the bitmap is valid, and the function returned an error in that case. Every valid bitmap, such as 0b0010 or 0b1110, was therefore rejected with TdxOperandInvalid. Bitmaps with reserved bits set, such as 0b0001 or 0b1_0000, were forwarded to the TDX module.

Intel describes the issue as an incorrect comparison and classifies it as escalation of privilege, with a CVSS 4.0 base score of 4.6, in INTEL-SA-01462.

The flaw was corrected in commit 311d33b, released in 0.3.1. The function now rejects an empty bitmap and any bit outside 0b1110.

Reported by Borys Tsyrulnikov.