Executive brief
dcap-qvl is a library used to verify Intel SGX and TDX remote attestation quotes, which are security credentials proving that code is running in a trusted processor. The library fails to cryptographically verify QE Identity data received from a configuration service, allowing an attacker to forge attestation credentials and bypass the entire remote attestation security model. Any system relying on dcap-qvl to validate quotes can be tricked into accepting forged or malicious attestations.
Technical details
The vulnerability is a missing cryptographic verification (CWE-295, CWE-347) in the dcap-qvl library's quote verification process. The library fetches QE Identity collateral (qe_identity, qe_identity_signature, and qe_identity_issuer_chain) from a Platform Certification Service (PCCS) but fails to validate the signature against its certificate chain and does not enforce policy constraints on the QE Report (MRSIGNER, ISVPRODID, ISVSVN checks). An attacker with network access to the PCCS endpoint can forge QE Identity data to whitelist a malicious Quoting Enclave, enabling them to sign untrusted quotes that verifiers will accept as legitimate. The vulnerability affects all versions prior to 0.3.9 across multiple package implementations (Rust, Python, Node.js, and pure JavaScript). The fix verifies the QE Identity signature and enforces the required policy constraints.
Affected products
- Phala Network dcap-qvl before 0.3.9
- Phala Network dcap-qvl-node through 0.3.3 (no patch available)
- Phala Network dcap-qvl-web through 0.3.3 (no patch available)
Timeline
- 2026-01-26: disclosed: Vulnerability publicly disclosed via GitHub Security Advisory
- 2026-01-26: patched: Patch released in dcap-qvl version 0.3.9 with QE Identity signature verification and policy constraint enforcement