PT-2026-4820 · Phala+1 · @Phala/Dcap-Qvl-Node+3
Rahul Saxena
·
Publicado
2026-01-26
·
Atualizado
2026-01-26
·
CVE-2026-22696
CVSS v4.0
9.3
Crítica
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
dcap-qvl versions prior to 0.3.9
Description
The dcap-qvl library contains a flaw in its quote verification logic. The library retrieves QE Identity collateral from the PCCS, but fails to verify the QE Identity signature against its certificate chain and does not enforce policy constraints on the QE Report. This allows an attacker to forge QE Identity data, potentially whitelisting a malicious or non-Intel Quoting Enclave and signing untrusted quotes that a verifier would accept as valid. This circumvents the remote attestation security model. All deployments using the dcap-qvl library for SGX or TDX quote verification are affected.
Recommendations
Upgrade to dcap-qvl version 0.3.9 to implement the missing cryptographic verification for the QE Identity signature and enforce checks for MRSIGNER, ISVPRODID, and ISVSVN against the QE Report.
Users of the
@phala/dcap-qvl-node and @phala/dcap-qvl-web packages should switch to the pure JavaScript implementation, @phala/dcap-qvl.Exploit
Correção
Improper Verification of Cryptographic Signature
Improper Certificate Validation
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
@Phala/Dcap-Qvl
@Phala/Dcap-Qvl-Node
@Phala/Dcap-Qvl-Web
Dcap-Qvl