CVE-2025-58354: Kata Containers coco-tdx malicious host can circumvent initdata verification

Vulnerability summary

CVE-2025-58354 is a medium (CVSS 6.9) vulnerability in kata-containers. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 26.8% of scored vulnerabilities.

Timeline

1. 23-09-2025
   PublishedVulnerability first disclosed.
2. 24-09-2025
   Last modifiedVulnerability information updated.

Description

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In Kata Containers versions from 3.20.0 and before, a malicious host can circumvent initdata verification. On TDX systems running confidential guests, a malicious host can selectively fail IO operations to skip initdata verification. This allows an attacker to launch arbitrary workloads while being able to attest successfully to Trustee impersonating any benign workload. This issue has been patched in Kata Containers version 3.21.0.

• CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.