Bug 2397724 (CVE-2025-58354) - CVE-2025-58354 kata-containers: Kata Containers coco-tdx malicious host can circumvent initdata verification
Summary: CVE-2025-58354 kata-containers: Kata Containers coco-tdx malicious host can c...
Keywords:
Status: NEW
Alias: CVE-2025-58354
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2400558 2400559
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-09-23 22:01 UTC by OSIDB Bzimport
Modified: 2025-09-30 22:25 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-09-23 22:01:36 UTC 
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In Kata Containers versions from 3.20.0 and before, a malicious host can circumvent initdata verification. On TDX systems running confidential guests, a malicious host can selectively fail IO operations to skip initdata verification. This allows an attacker to launch arbitrary workloads while being able to attest successfully to Trustee impersonating any benign workload. This issue has been patched in Kata Containers version 3.21.0.
Note You need to log in before you can comment on or make changes to this bug.