{"id":"CVE-2026-62929","kind":"vulnerability","aliases":["CVE-2026-62929"],"related":[],"title":"Intel TDX MigTD: expired pointer dereference lets a privileged attacker escalate","description":"Expired pointer dereference in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","summary":"The virtio-vsock implementation in Intel's TDX Migration Trust Domain (MigTD) dereferences an expired pointer. A privileged system-software attacker on the host can escalate privilege and read or change data inside the trust domain.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Intel TDX Migration TD (MigTD) reference software","fixed":["0.7.2"],"affected":"< 0.7.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["confidential-computing","infrastructure","intel-tdx","virtualization"],"not_affected_if":["no-td-migration","no-tdx"],"how_to_check":"Check the MigTD build you deploy for live migration of TDX trust domains: any MigTD reference software version before 0.7.2 is affected per INTEL-SA-01580. Rebuild or redeploy from v0.7.2 or later.","fix":"Update Intel TDX Migration TD (MigTD) reference software to v0.7.2 or later (https://github.com/intel/MigTD/releases/tag/v0.7.2).","status":"open","published_at":"2026-11-10T18:17:45+00:00","first_seen_at":"2026-11-10T18:23:00+00:00","triaged_at":"2026-11-10T18:24:26+00:00","updated_at":"2026-11-10T18:26:01+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T18:24:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel TDX MigTD: expired pointer dereference lets a privileged attacker escalate","impact":"high","summary":"The virtio-vsock implementation in Intel's TDX Migration Trust Domain (MigTD) dereferences an expired pointer. A privileged system-software attacker on the host can escalate privilege and read or change data inside the trust domain.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel-tdx","confidential-computing","virtualization"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"privileged local attacker escalates privilege and reads or alters trust domain data","analyst_note":"Find Intel's security advisory for this CVE to confirm affected versions, fixed firmware or MigTD versions, and mitigations.","how_to_check":"unknown","plain_action":"","product_name":"Intel TDX MigTD","needs_analyst":true,"not_affected_if":["no-tdx"],"who_is_affected":"Affects hosts running Intel TDX with the MigTD migration component and its virtio-vsock path enabled. The sources do not say which versions are affected or whether the default configuration is exposed. Teams not running Intel TDX live migration can likely skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4688,"output_tokens":504,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Intel's security advisory for this CVE to confirm affected versions, fixed firmware or MigTD versions, and mitigations.","search":"'-2026':13A,16A '-62929':14A,17A '0':93C 'access':129C 'adversari':106C 'allow':96C 'attack':10A,55B,116C,131C 'avail':156C,171C 'chang':65B 'combin':111C 'complex':115C 'comput':27B 'confidenti':26B,151C,166C 'confidential-comput':25B 'cve':12A,15A 'data':66B 'derefer':6A,46B,73C 'disclosur':103C 'domain':44B,70B,89C 'enabl':118C 'escal':11A,60B,98C,119C 'expir':4A,48B,71C 'high':152C,154C,157C 'host':58B 'hypervisor':94C 'impact':149C,173C 'implement':37B,81C 'inform':102C 'infrastructur':28B 'insid':67B 'integr':153C,168C 'intel':1A,18A,30B,39B,84C 'intel-tdx':29B 'interact':144C 'intern':138C 'knowledg':139C 'let':7A 'local':128C 'low':114C 'may':95C,117C,124C,148C 'migrat':42B,87C 'migration':20A 'migtd':3A,22A,45B,76C,90C 'none':167C,169C,172C 'occur':126C 'pointer':5A,49B,72C 'potenti':125C,146C 'present':135C 'privileg':9A,51B,61B,100C,109C,121C 'r':85C 'read':63B 'reference':23A 'requir':132C,141C 'result':123C,162C 'ring':92C 'softwar':54B,105C 'software':24A 'special':137C 'subsequ':164C 'system':53B,104C,161C,165C 'system-softwar':52B 'td':21A 'tdx':2A,19A,31B,41B,86C 'trust':43B,69B,88C 'user':110C,143C 'via':127C 'virtio':35B,79C 'virtio-vsock':34B,78C 'virtual':32B 'vsock':36B,80C 'vulner':147C,160C 'within':91C 'without':136C","nicknames":[],"mitigations":[],"who_affected":"Teams running Intel TDX confidential VMs with live migration, using the MigTD reference software before version 0.7.2. The flaw is in MigTD's virtio-vsock code and needs a privileged attacker on the host (system software, local access). Hosts and clouds not using TDX migration can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T18:26:01Z","by":"analyst","doc":"https://github.com/intel/MigTD/releases/tag/v0.7.2","run_id":2488},"products":{"at":"2026-11-10T18:26:01Z","by":"analyst","doc":"https://github.com/intel/MigTD/releases/tag/v0.7.2","run_id":2488},"who_affected":{"at":"2026-11-10T18:26:01Z","by":"analyst","doc":"https://github.com/intel/MigTD/releases/tag/v0.7.2","run_id":2488}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["inteltdxmigrationtdmigtdreferencesoftware","tdxmigrationtdmigtdreferencesoftware"],"ptokens":["intel","migration","migtd","reference","software","td","tdx"],"labels":["confidentialcomputing","high","infrastructure","inteltdx","virtualization"],"campaign_type":null,"search_a":"'-2026':13A,16A '-62929':14A,17A 'attack':10A 'cve':12A,15A 'derefer':6A 'escal':11A 'expir':4A 'intel':1A,18A 'let':7A 'migration':20A 'migtd':3A,22A 'pointer':5A 'privileg':9A 'reference':23A 'software':24A 'td':21A 'tdx':2A,19A","search_b":"'attack':55B 'chang':65B 'comput':27B 'confidenti':26B 'confidential-comput':25B 'data':66B 'derefer':46B 'domain':44B,70B 'escal':60B 'expir':48B 'host':58B 'implement':37B 'infrastructur':28B 'insid':67B 'intel':30B,39B 'intel-tdx':29B 'migrat':42B 'migtd':45B 'pointer':49B 'privileg':51B,61B 'read':63B 'softwar':54B 'system':53B 'system-softwar':52B 'tdx':31B,41B 'trust':43B,69B 'virtio':35B 'virtio-vsock':34B 'virtual':32B 'vsock':36B","search_c":"'0':93C 'access':129C 'adversari':106C 'allow':96C 'attack':116C,131C 'avail':156C,171C 'combin':111C 'complex':115C 'confidenti':151C,166C 'derefer':73C 'disclosur':103C 'domain':89C 'enabl':118C 'escal':98C,119C 'expir':71C 'high':152C,154C,157C 'hypervisor':94C 'impact':149C,173C 'implement':81C 'inform':102C 'integr':153C,168C 'intel':84C 'interact':144C 'intern':138C 'knowledg':139C 'local':128C 'low':114C 'may':95C,117C,124C,148C 'migrat':87C 'migtd':76C,90C 'none':167C,169C,172C 'occur':126C 'pointer':72C 'potenti':125C,146C 'present':135C 'privileg':100C,109C,121C 'r':85C 'requir':132C,141C 'result':123C,162C 'ring':92C 'softwar':105C 'special':137C 'subsequ':164C 'system':104C,161C,165C 'tdx':86C 'trust':88C 'user':110C,143C 'via':127C 'virtio':79C 'virtio-vsock':78C 'vsock':80C 'vulner':147C,160C 'within':91C 'without':136C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62929","severity":null,"published_at":"2026-11-10T18:17:45+00:00","modified_at":"2026-11-10T18:17:45+00:00","first_seen_at":"2026-11-10T18:23:00+00:00","fetched_at":"2026-11-10T18:23:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-62929:2488","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","severity":null,"published_at":"2026-11-10T18:26:01+00:00","modified_at":"2026-11-10T18:26:01+00:00","first_seen_at":"2026-11-10T18:26:01+00:00","fetched_at":"2026-11-10T18:26:01+00:00","note":"INTEL-SA-01580 (11/10/2026, Intel rates the advisory Medium; this CVE CVSS 4.0 8.4): MigTD before 0.7.2 affected, update to 0.7.2+. No mitigations listed. No exploitation or PoC seen; did not search social posts. I did not open the v0.7.2 release page itself; the version came from the advisory.","cites":["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","https://github.com/intel/MigTD/releases/tag/v0.7.2"]}],"documents":[{"id":117041,"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","title":"INTEL-SA-01580 Intel TDX Migration Trust Domain (MigTD) Advisory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":117043,"url":"https://github.com/intel/MigTD/releases/tag/v0.7.2","title":"intel/MigTD v0.7.2","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}