{"id":"CVE-2026-60142","kind":"vulnerability","aliases":["CVE-2026-60142"],"related":[],"title":"Intel TDX MigTD: write-what-where flaw lets a privileged local user escalate","description":"Write-what-where condition in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an information disclosure and escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","summary":"Intel's MigTD component for TDX Migration Trust Domains has a write-what-where memory flaw that a privileged local adversary can use to escalate privilege. The sources say it can also lead to information disclosure and loss of integrity and availability on the affected system.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Intel TDX Migration Trust Domain (MigTD) reference software","fixed":["0.7.2"],"affected":"< 0.7.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["confidential-computing","hypervisor","infrastructure","intel","local","migtd","tdx"],"not_affected_if":["no-tdx-migration"],"how_to_check":"Check the MigTD reference software version your TDX migration setup builds or ships; versions before 0.7.2 are affected. If you get MigTD from your platform or cloud vendor, ask them for the MigTD version or their INTEL-SA-01580 status. Skip this if you do not use TDX live migration.","fix":"Update Intel TDX Migration Trust Domain (MigTD) reference software to version 0.7.2 or later.","status":"open","published_at":"2026-11-10T18:17:43+00:00","first_seen_at":"2026-11-10T18:23:00+00:00","triaged_at":"2026-11-10T18:24:27+00:00","updated_at":"2026-11-10T18:26:01+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T18:24:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel TDX MigTD: write-what-where flaw lets a privileged local user escalate","impact":"high","summary":"Intel's MigTD component for TDX Migration Trust Domains has a write-what-where memory flaw that a privileged local adversary can use to escalate privilege. The sources say it can also lead to information disclosure and loss of integrity and availability on the affected system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel","tdx","confidential-computing","hypervisor"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Privileged local attacker escalates privilege and reads or alters protected data","analyst_note":"Check Intel's security advisory for the affected and fixed MigTD versions and the mitigation for CVE-2026-60142; the NVD entry lacks product ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-tdx-migration"],"who_is_affected":"Affects Intel TDX Migration Trust Domain (MigTD) deployments, which run in a hypervisor-managed confidential computing environment. The sources do not say which MigTD versions are vulnerable or how to tell whether a given host runs them. Teams not using TDX live migration are unlikely to be exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4677,"output_tokens":515,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Intel's security advisory for the affected and fixed MigTD versions and the mitigation for CVE-2026-60142; the NVD entry lacks product ranges.","search":"'-2026':16A,19A '-60142':17A,20A '0':104C 'access':140C 'adversari':59B,117C 'affect':83B 'allow':107C 'also':70B 'attack':127C,142C 'avail':80B,167C,182C 'combin':122C 'complex':126C 'compon':41B 'comput':31B 'condit':89C 'confidenti':30B,162C,177C 'confidential-comput':29B 'cve':15A,18A 'disclosur':74B,110C 'domain':25A,46B,100C 'enabl':129C 'escal':14A,63B,112C,130C 'flaw':8A,54B 'high':163C,165C,168C 'hypervisor':32B,105C 'impact':160C,184C 'inform':73B,109C 'infrastructur':33B 'integr':78B,164C,179C 'intel':1A,21A,34B,38B,95C 'interact':155C 'intern':149C 'knowledg':150C 'lead':71B 'let':9A 'local':12A,35B,58B,139C 'loss':76B 'low':125C 'may':106C,128C,135C,159C 'memori':53B 'migrat':44B,98C 'migration':23A 'migtd':3A,26A,36B,40B,92C,101C 'none':178C,180C,183C 'occur':137C 'potenti':136C,157C 'present':146C 'privileg':11A,57B,64B,114C,120C,132C 'r':96C 'reference':27A 'requir':143C,152C 'result':134C,173C 'ring':103C 'say':67B 'softwar':116C 'software':28A 'sourc':66B 'special':148C 'subsequ':175C 'system':84B,115C,172C,176C 'tdx':2A,22A,37B,43B,97C 'trust':24A,45B,99C 'use':61B 'user':13A,121C,154C 'via':138C 'vulner':158C,171C 'within':102C 'without':147C 'write':5A,50B,86C 'write-what-wher':4A,49B,85C","nicknames":[],"mitigations":[],"who_affected":"Intel's advisory INTEL-SA-01580 says all versions of the MigTD reference software before 0.7.2 are affected. Exposure needs a privileged local attacker (system software adversary) on a TDX host that runs MigTD for TD migration. Teams not using TDX migration, and ordinary application developers, can skip it; hosting providers and operators of TDX hosts should check.","tier":"B","verified":{"fix":{"at":"2026-11-10T18:26:01Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","run_id":2489},"products":{"at":"2026-11-10T18:26:01Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","run_id":2489},"who_affected":{"at":"2026-11-10T18:26:01Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","run_id":2489}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["inteltdxmigrationtrustdomainmigtdreferencesoftware","tdxmigrationtrustdomainmigtdreferencesoftware"],"ptokens":["domain","intel","migration","migtd","reference","software","tdx","trust"],"labels":["confidentialcomputing","high","hypervisor","infrastructure","intel","local","migtd","tdx"],"campaign_type":null,"search_a":"'-2026':16A,19A '-60142':17A,20A 'cve':15A,18A 'domain':25A 'escal':14A 'flaw':8A 'intel':1A,21A 'let':9A 'local':12A 'migration':23A 'migtd':3A,26A 'privileg':11A 'reference':27A 'software':28A 'tdx':2A,22A 'trust':24A 'user':13A 'write':5A 'write-what-wher':4A","search_b":"'adversari':59B 'affect':83B 'also':70B 'avail':80B 'compon':41B 'comput':31B 'confidenti':30B 'confidential-comput':29B 'disclosur':74B 'domain':46B 'escal':63B 'flaw':54B 'hypervisor':32B 'inform':73B 'infrastructur':33B 'integr':78B 'intel':34B,38B 'lead':71B 'local':35B,58B 'loss':76B 'memori':53B 'migrat':44B 'migtd':36B,40B 'privileg':57B,64B 'say':67B 'sourc':66B 'system':84B 'tdx':37B,43B 'trust':45B 'use':61B 'write':50B 'write-what-wher':49B","search_c":"'0':104C 'access':140C 'adversari':117C 'allow':107C 'attack':127C,142C 'avail':167C,182C 'combin':122C 'complex':126C 'condit':89C 'confidenti':162C,177C 'disclosur':110C 'domain':100C 'enabl':129C 'escal':112C,130C 'high':163C,165C,168C 'hypervisor':105C 'impact':160C,184C 'inform':109C 'integr':164C,179C 'intel':95C 'interact':155C 'intern':149C 'knowledg':150C 'local':139C 'low':125C 'may':106C,128C,135C,159C 'migrat':98C 'migtd':92C,101C 'none':178C,180C,183C 'occur':137C 'potenti':136C,157C 'present':146C 'privileg':114C,120C,132C 'r':96C 'requir':143C,152C 'result':134C,173C 'ring':103C 'softwar':116C 'special':148C 'subsequ':175C 'system':115C,172C,176C 'tdx':97C 'trust':99C 'user':121C,154C 'via':138C 'vulner':158C,171C 'within':102C 'without':147C 'write':86C 'write-what-wher':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60142","severity":null,"published_at":"2026-11-10T18:17:43+00:00","modified_at":"2026-11-10T18:17:43+00:00","first_seen_at":"2026-11-10T18:23:00+00:00","fetched_at":"2026-11-10T18:23:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-60142:2489","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","severity":null,"published_at":"2026-11-10T18:26:01+00:00","modified_at":"2026-11-10T18:26:01+00:00","first_seen_at":"2026-11-10T18:26:01+00:00","fetched_at":"2026-11-10T18:26:01+00:00","note":"Intel INTEL-SA-01580 (11/10/2026, advisory rated Medium; this CVE CVSS 4.0 8.4 High, AV:L PR:H): affected MigTD < 0.7.2, fixed 0.7.2. No workarounds section seen, no exploitation or PoC found. Advisory read via WebFetch summary for the tail section; the web-cli text was truncated.","cites":["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"]}],"documents":[{"id":117041,"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","title":"INTEL-SA-01580 Intel TDX Migration Trust Domain (MigTD) Advisory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}