# Borys Tsyrulnikov

> I am a security researcher. I examine hardware attestation, confidential computing SDKs, TEE quote verifiers, and enclave tools.

Canonical page: [borystsyrulnikov.dev](https://borystsyrulnikov.dev/)

## Writing

### [Two bugs in Intel's TDX guest crate](https://borystsyrulnikov.dev/posts/tdx-guest-l2-vm-bugs/)

Published 2026-08-17.

One TDCALL wrapper discarded a correctly packed RCX value. Another inverted a bitmap validation check. Intel fixed both bugs in `tdx-guest` 0.3.1.

## In the public record

### Intel

I found two privilege-escalation defects in Intel TDX Guest software. Intel rated both issues 4.6 Medium and corrected them in version 0.3.1. The assessment requires a local, highly privileged attacker.

- [INTEL-SA-01462](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01462.html)
- [CVE-2026-20763](https://nvd.nist.gov/vuln/detail/CVE-2026-20763)
- [CVE-2026-20765](https://nvd.nist.gov/vuln/detail/CVE-2026-20765)
- Published 2026-08-11

### Microsoft

I found an out-of-bounds read in the Open Enclave SDK quote parser. Unguarded pointer arithmetic read an attacker-controlled SGX quote buffer. Microsoft rated the issue Low severity and corrected it in version 0.19.16.

- [GHSA-cpr6-5fw2-32xx](https://github.com/openenclave/openenclave/security/advisories/GHSA-cpr6-5fw2-32xx)
- Published 2026-07-14

### Linux kernel

I found an off-by-one mask and incorrect 32-bit zero-extension in the x86/TDX code for port I/O. The patches have my Reported-by credit and a Cc stable tag.

- [Off-by-one fix](https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=0f63e656b1c679d32ac595de29d10c03efca6a25)
- [Zero-extension fix](https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=941370fc93cc3474e26811f4d3b062903eefe2cf)
- Published 2026-07-13

### DPDK

I wrote the fix for a double free in the vectorized receive recovery path of NVIDIA mlx5. NVIDIA reviewed and approved the fix. DPDK backported it to the 25.11 stable branch.

- [Upstream fix](https://github.com/DPDK/dpdk/commit/7b3add55404dd816f1e9610097b2a7ac1fca4713)
- [25.11 backport](https://github.com/DPDK/dpdk-stable/commit/c1e7bc1515d45ad006826831719dbba1ead50c29)
- Component: net/mlx5
- Published 2026-06-17

## Other accepted reports

### Fortanix

I reported missing server authentication in the salmiac KMS client. The defect let an untrusted Nitro parent get the LUKS2 passphrase. Fortanix corrected the defect in pull request 106 and gave me credit in a private advisory.

- [salmiac pull request 106](https://github.com/fortanix/salmiac/pull/106)
- CWE-295
- Published 2026-07-02

### Intel

Intel accepted four additional reports for attestation software and key broker software. Intel has not published the details. I keep the details private during coordinated disclosure.

## Contact

- [About](https://borystsyrulnikov.dev/about.md)
- [Email](mailto:tsyrulnikov.borys@gmail.com)
- [RSS](https://borystsyrulnikov.dev/feed.xml)