Vulnerability RUSTSEC-2026-0485

tdx_guest::tdcall::enter_l2_vcpu() invokes the TDG.VP.ENTER TDCALL. RCX must carry the L2 VM index in bits 53:52 and the invalidation control value (InvdTranslations, 0 to 3) in bits 1:0. The function computed that value as (l2_vm_idx << 52) | (invd_translations as u64), but then passed the raw l2_vm_idx in RCX instead.

As a result, the TDX module received an operand that differs from the caller's request. The VM index field was 0, and the low bits of the index were interpreted as the invalidation control value. For example, VM 1 with InvdTlb (2) should produce 0x0010_0000_0000_0002, but produced 0x1.

Intel describes the issue as an incorrect calculation and classifies it as escalation of privilege, with a CVSS 4.0 base score of 4.6, in INTEL-SA-01462.

The flaw was corrected in commit 311d33b, released in 0.3.1, which passes the computed RCX value.

Reported by Borys Tsyrulnikov.