Skip to content

Back to the catalog

EarlyAttestationBleed Paper Review (TEE attestation bugs)
collective.flashbots.netwriteup

EarlyAttestationBleed Paper Review (TEE attestation bugs)

A Flashbots researcher reviews the EarlyAttestationBleed paper (Muhammad Usama Sardar and Songbo Bu), which uses ProVerif formal analysis to uncover three attestation-verification bugs in confidential-computing deployments: Cocos AI's TDX verifier fails to actually compare the REPORT_DATA value despite computing it correctly, Cocos AI's SEV-SNP validator skips the comparison entirely when an empty expected-input value is passed, and Edgeless Systems' Contrast workload-policy logic can be tricked into accepting container images from untrusted host-controlled storage due to a rebase mistake. All three were implementation bugs (not protocol design flaws) and have since been fixed; the post also summarizes the paper's broader concerns about "early attestation" — exposing hardware details pre-authentication, lack of post-handshake re-attestation for long-lived sessions, and handshake-timeout tradeoffs from added attestation latency.

TL;DR Review of the EarlyAttestationBleed paper: real attestation-verifier bugs in Cocos AI (TDX/SEV-SNP) and Edgeless Systems' Contrast, plus lessons for designing attested-TLS.
Open original ↗
Document

What it is

The page adds the author's own commentary on the EarlyAttestationBleed paper (Sardar and Bu) beyond the paper's bug catalog: a comparison to the earlier related paper Intrahandshake.fail, and a specific engineering takeaway from finding #3 (the Contrast container-image bug).

How it works

Intrahandshake.fail critiqued the general design paradigm of remote-attested TLS protocols; EarlyAttestationBleed is narrower, targeting implementation-level verifier logic in two specific projects (Cocos AI, Edgeless Contrast) rather than protocol design. The author flags Contrast's workload-policy bug as the most broadly relevant lesson here: even with a sound attested-TLS protocol, policy logic governing which container images/workloads are trusted is complex enough that bugs (like loading images from untrusted host-controlled storage) can slip through undetected.

Preconditions / Affected

Relevant to teams building or relying on attested-TLS systems with separate policy-enforcement layers for workload/container verification — not just the core attestation handshake.

What to do

The author's concrete recommendation: ensure all edge cases in workload-policy logic are covered by tests, since this class of bug (policy logic accepting something it shouldn't) is easy to miss even when the underlying attestation protocol is correct.

Caveats

The author explicitly states this analysis confirms none of the three bugs affect Flashbots services, and all three have already been fixed upstream — the value here is the lessons-learned framing, not an active risk.

Organisations named here

  • EarlyAttestationBleed
  • Edgeless Systems Contrast
  • Intrahandshake.fail
  • Muhammad Usama Sardar
  • REPORT_DATA
  • Songbo Bu

Technologies named here

  • Cocos AI
  • Edgeless Systems' Contrast
  • ProVerif
  • Intel TDX
  • AMD SEV-SNP
  • TLS

Techniques named here

  • Early attestation in TLS handshake
  • REPORT_DATA / input value binding bypass
  • Validator check omission via empty expected value
  • Untrusted host-controlled image/storage manipulation

Related in Hardware & RF