![\"Futuristic](\".\/media_183ca34af4ced58767b4292f79683429b8f37b388.jpg?width=750&format=jpg&optimize=medium\")
<\/p>\nIn detailing vulnerabilities that Intel later remediated, Google\u2019s security researchers say the most significant one they found in the Xeon confidential computing feature \u2018would have allowed an untrusted operator to completely compromise the security guarantees of TDX.\u2019<\/p>\n
<\/p>\n
Intel said Tuesday that Google\u2019s cloud security team helped the chipmaker identify five vulnerabilities in the most advanced confidential computing feature of its Xeon CPUs.<\/p>\n
The work, which resulted in the remediation of such vulnerabilities, was part of a five-month joint security review between Intel and Google security researchers into the code for version 1.5 of the semiconductor giant\u2019s Trust Domain Extensions feature.<\/p>\n
[Related: 5 Ways AI Chips Are Accelerating Security Advancements<\/a>]<\/p>\n With the review representing an ongoing collaboration between the two companies, Google\u2019s security researchers said the \u201ccomplexity of modern systems makes continuous assessment essential,\u201d adding that \u201ccollaborative reviews allow industry leaders to proactively fix vulnerabilities while fostering transparency for everyone who relies on the technology.\u201d<\/p>\n \u201cThis research illustrates why Intel is committed to never stop looking for security issues in our products,\u201d Intel said in its own statement announcing Google\u2019s research findings. \u201cCustomers can take confidence that it\u2019s not just Intel working to strengthen our technology, but the ecosystem working together to enhance protection.\u201d<\/p>\n Shortened as TDX, Trust Domain Extensions represents the most advanced confidential computing feature in Intel\u2019s Xeon processors, and it\u2019s used by Google Cloud, Microsoft Azure and Alibaba Cloud to offer additional protection for customer data.<\/p>\n The feature is designed to protect sensitive data and applications from unauthorized access by isolating virtual machines from the hypervisor and other software. It\u2019s available in the fifth-generation Xeon<\/a> and Xeon 6<\/a> product lines while availability in the fourth generation is limited to custom models for cloud service providers.<\/p>\n In a blog post<\/a>, Google\u2019s security researchers said the most significant vulnerability it found related to the Live Migration feature of TDX 1.5. This \u201cwould have allowed an untrusted operator to completely compromise the security guarantees of TDX,\u201d they wrote.<\/p>\n The vulnerability allowed the host of a TDX environment to access a hardware-isolated virtual machine\u2014also known as a Trust Domain, or TD for short\u2014when using Live Migration to move the instance to another physical machine by changing its attributes from \u201cmigratable\u201d to \u201cdebug,\u201d the researchers said.<\/p>\n \u201cOnce triggered the entire decrypted TD state is accessible from the host. At this point a malicious host could construct another TD with the decrypted state or perform live monitoring activities,\u201d they wrote, adding that such actions could be completed after a TD \u201ccompleted attestation\u201d to indicate that it\u2019s protected.<\/p>\n This and four other vulnerabilities found by Google\u2019s team were patched by Intel in the most recent version of the TDX Module code for Xeon processors, according to the chipmaker.<\/p>\n The security review also resulted in Google researchers finding 35 \u201cless critical\u201d weaknesses, bugs and improvement opportunities. Some of these smaller issues are expected to be addressed in future TDX Module code updates.<\/p>\n Among the recommendations from Google researchers is an architecture improvement they call Attestable Global Feature Disablement, which the team said \u201cwould limit attack surface growth by allowing a host to enable only used features and interfaces during TDX Module initialization.\u201d<\/p>\n The Google security researchers said they identified the TDX security issues between the spring and fall of last year by performing a \u201cthorough API review\u201d of changes since TDX version 1.0. This work was augmented with the use of static analysis tools and the development of a \u201cbespoke Python-based experimentation framework\u201d called TDXplore to \u201cexplore complex flows and edge cases,\u201d according to the team.<\/p>\n The researchers said they also \u201cleveraged\u201d Google\u2019s Gemini 2.5 Pro<\/a> AI reasoning model and NotebookLM<\/a> AI research tool to \u201cnavigate technical specifications and aid with analysis.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"In detailing vulnerabilities that Intel later remediated, Google\u2019s security researchers say the most significant one they found in…\n","protected":false},"author":2,"featured_media":277317,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[59859,111,139,69,145,77487],"class_list":{"0":"post-277316","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-technology","8":"tag-cpus","9":"tag-new-zealand","10":"tag-newzealand","11":"tag-nz","12":"tag-technology","13":"tag-vulnerabilities"},"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/277316","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=277316"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/277316\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/277317"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=277316"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=277316"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=277316"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}