[Ufmrg] EarlyAttestationBleed: Three Critical-severity Vulnerabilities of CVSS ≥ 9.0 in Confidential Computing

[Muhammad Usama Sardar <[e-mail]>]

Hi all,

# *Context*

At SEAL chartering time, IESG (e.g., [0]) and IETF participants (e.g., 
[1]) requested operational guidance for attested TLS. We did some 
relevant formal analysis and would like to share our paper presenting 
the results of our analysis with the RG for feedback and for information 
of other implementers to secure their systems.

# *Key Findings*

Our paper covers the following two implementations of early attestation:

## *1. Ultraviolet Cocos AI*

Ultraviolet claimed to be the most secure attested TLS solution in 
Confidential Computing Consortium (CCC). We discovered two 
critical-severity [2] (CVSS 9.1) vulnerabilities in their implementation 
of early attestation. Published GitHub Security Advisories (GHSAs) [3,4] 
are quite detailed and explicitly cite arguments against 
draft-fossati-seat-early-attestation. So we won't repeat that here.

Moreover, two CVEs of CVSS 9.1 have been issued: CVE-2026-92701 [5] and 
CVE-2026-92702 [6].

## *2. Edgeless Systems Contrast*

Edgeless Systems was awarded second place in the cybersecurity category 
of the WirtschaftsWoche’s well-known "Best of Technology Awards" this 
year [7]. We analyzed its attested TLS solution named Contrast, and 
found a critical vulnerability in the CVSS range 9.0 to the maximum 
possible 10.0. GHSA on this is published [8].

# *Discovery Methodology*

  * Formal analysis using state-of-the-art tool ProVerif
  * Implementation-level regression tests for confirmation
  * Reviewed and confirmed by developers
  * GHSAs published [3,4]
  * CVEs issued [5,6]
  * Contrast maintainers have requested CVE for GHSA [8]; review by
    GitHub is in progress for issuing the CVE

# *Ethical Considerations*

We kept the vulnerabilities under strict /responsible disclosure/ until 
confirmed and published by the developers. Cocos AI has moved to 
post-handshake attestation, while Edgeless Systems currently maintains 
early attestation.

# *Paper*

Please see [9].

# *Acknowledgments*

  * Cocos AI maintainers (Sammy Kerata Oina and Drasko Draskovic)
  * Edgeless Systems Contrast maintainer (Markus Rudy)
  * Bertrand Foing
  * Rebekah Overdorf and Tobias Pulls

We welcome any feedback and collaborators for further research on this 
topic. We surely need your help.

Best regards,

-Usama and Songbo


PS: The name is inspired from Heartbleed, which was CVSS 7.5. CVSS 9.1 
and 9.0-10.0 is surely more bleeding than Heartbleed.


[0] https://mailarchive.ietf.org/arch/msg/seal/BJmfAFQxap4tDNfNbCbhRfGwJ3s/

[1] https://mailarchive.ietf.org/arch/msg/seal/oNtTWnQ409zxqYYbWHNeUflcC3s/

[2] https://nvd.nist.gov/vuln-metrics/cvss

[3] 
https://github.com/ultravioletrs/cocos/security/advisories/GHSA-4px3-wj2x-xx47

[4] 
https://github.com/ultravioletrs/cocos/security/advisories/GHSA-4r6g-mp48-j2rw

[5] https://www.cve.org/CVERecord?id=CVE-2026-92701

[6] https://www.cve.org/CVERecord?id=CVE-2026-92702

[7] https://award.wiwo.de/bot/gewinner-2026/

[8] 
https://github.com/edgelesssys/contrast/security/advisories/GHSA-m2qg-wrxv-h898

[9] 
https://www.researchgate.net/publication/414529199_EarlyAttestationBleed_Three_Critical-severity_Vulnerabilities_of_CVSS_90_in_Confidential_Computing