Security Assessment of Intel TDX with support for Live Migration
Kirk Swidowski, Daniel Moghimi, Josh Eads, Erdem Aktas, Jia Ma

TL;DR
This paper reports on a security assessment of Intel TDX with support for live migration, revealing vulnerabilities that could compromise confidential computing environments and emphasizing the need for layered security measures.
Contribution
First comprehensive security evaluation of Intel TDX with live migration support, identifying critical vulnerabilities and providing insights for improving confidential computing security.
Findings
Discovered a vulnerability allowing full compromise of a TD by a VMM.
Identified four vulnerabilities enabling memory leaks to malicious VMM or TD.
Highlighted the importance of iterative security refinement and defense-in-depth strategies.
Abstract
In the second and third quarters of 2025, Google collaborated with Intel to conduct a security assessment of Intel Trust Domain Extensions (TDX), extending Google's previous review and covering major changes since Intel TDX Module 1.0 - namely support for Live Migration and Trusted Domain (TD) Partitioning (nested VMs within TDs). Intel provided guidance and support, including documentation and updated TDX 1.5 source code. Unlike the previous review, this time, we had access to a compute node capable of running TDX to develop a toolkit for live testing and Proof-of-Concept (PoC) generation. Furthermore, we integrated Gemini for analysis and NotebookLM to efficiently navigate complex specifications. This assessment resulted in the discovery of one vulnerability that enables a VMM to fully compromise a TD, and four vulnerabilities that enable a malicious VMM or TD to leak confidential…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSecurity and Verification in Computing · Physical Unclonable Functions (PUFs) and Hardware Security · Distributed systems and fault tolerance
