CVE-2024-33607
📋 TL;DR
This vulnerability is an out-of-bounds read in Intel TDX module software that could allow an authenticated attacker with local access to read sensitive information from memory. It affects systems running Intel TDX module software before version TDX_1.5.07.00.774. The risk is limited to authenticated users with local access to vulnerable systems.
💻 Affected Systems
- Intel TDX Module Software
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could read sensitive information from protected memory regions, potentially exposing encryption keys, credentials, or other confidential data.
Likely Case
Information disclosure of non-critical system data or application memory contents, though exploitation requires specific conditions and local access.
If Mitigated
Minimal impact with proper access controls and monitoring in place, as exploitation requires authenticated local access.
🎯 Exploit Status
Exploitation requires authenticated local access and knowledge of memory layout. No public exploits known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: TDX_1.5.07.00.774 or later
Vendor Advisory: https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01192.html
Restart Required: No
Instructions:
1. Download the updated TDX module software from Intel. 2. Follow Intel's update instructions for your specific platform. 3. Verify the update was successful by checking the TDX module version.
🔧 Temporary Workarounds
Restrict Local Access
allLimit local access to systems with TDX enabled to trusted users only.
🧯 If You Can't Patch
- Implement strict access controls to limit local access to vulnerable systems
- Monitor for unusual memory access patterns or privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check the TDX module version on your system. If it's older than TDX_1.5.07.00.774, the system is vulnerable.Check Version:
Check system documentation or BIOS/UEFI settings for TDX module version information.Verify Fix Applied:
Verify the TDX module version is TDX_1.5.07.00.774 or newer after applying the update.📡 Detection & Monitoring
Log Indicators:
- Unusual memory access patterns from authenticated users
- Failed attempts to access protected memory regions
Network Indicators:
- Not applicable - local access only vulnerability
SIEM Query:
Search for authentication events followed by unusual process memory access patterns on systems with TDX enabled.