MigTD v0.7.2 Release

[sgrams]

Summary

MigTD v0.7.2 is a major hardening and stability release focused heavily on security audit remediations, memory safety mitigations, driver hardening, and dependency maintenance.

Key Highlights & Changes

Security Audit & Hardening

• Addressed extensive security audit findings across PCI/MMIO bounds, BAR sizing, and TD private DRAM overlap protection.
• Hardened SPDM, TLS, and crypto paths: wiped migration key materials from buffers, improved error propagation, added back-pressure handling, and made ExchangeMigrationInfoReq one-shot.
• Enforced quote/report validation, hardened collateral fetching, and fenced insecure test attestation features from release builds.
• Resolved advisory GHSA-4w2j-m93h-cj5j via quinn-proto update.

Virtio & Device Drivers

• Fixed virtio memory region bounds checking, port ID validation, DMA free ordering, and virtqueue ring page deallocation.
• Hardened virtqueue descriptors, packet/credit validation in vsock, and removed dead debug helpers.

Policy & Metadata

• Added TD_INFO to default metadata alongside a dedicated compatibility build mode.
• Hardened policy v2 TCB date comparisons (rejecting non-canonical dates) and improved hex/collateral error handling.

Build, CI & Scripts

• Updated Linux SGX dependencies to sgx_2.30.
• Grouped and upgraded GitHub Actions (CodeQL, Harden-Runner, Scorecard) and Rust toolchains.
• Fixed release directory creation and script attribute handling (user-td.sh).
• Added AI assistance policy guidelines to CONTRIBUTING.md.

What's Changed

• build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 by @dependabot[bot] in build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 #925
• build(deps): bump dtolnay/rust-toolchain from 67ef31d5b988238dd797d409d6f9574278e20537 to fa04a1451ff1842e2626ccb99004d0195b455a88 by @dependabot[bot] in build(deps): bump dtolnay/rust-toolchain from 67ef31d5b988238dd797d409d6f9574278e20537 to fa04a1451ff1842e2626ccb99004d0195b455a88 #926
• build(deps): bump ubuntu from 53958ec to b7f4819 in /container by @dependabot[bot] in build(deps): bump ubuntu from 53958ec to b7f4819 in /container #923
• fix(virtio): MemoryRegion slice bounds use byte length from security … by @MichalTarnacki in fix(virtio): MemoryRegion slice bounds use byte length from security … #948
• fix(virtio_serial): port_id validation and DMA free ordering from sec… by @MichalTarnacki in fix(virtio_serial): port_id validation and DMA free ordering from sec… #947
• fix(vmcall_raw): return constructed error instead of discarding it by @MichalTarnacki in fix(vmcall_raw): return constructed error instead of discarding it #946
• fix(policy): hex parsing and collateral handling from security audit by @MichalTarnacki in fix(policy): hex parsing and collateral handling from security audit #945
• fix(collateral-generator): cap PCS response body before deserialize by @MichalTarnacki in fix(collateral-generator): cap PCS response body before deserialize #944
• fix(vsock): remove dead virtio_dump debug helper by @MichalTarnacki in fix(vsock): remove dead virtio_dump debug helper #938
• fix(virtio/mem): reject BAR regions overlapping TD private DRAM by @MichalTarnacki in fix(virtio/mem): reject BAR regions overlapping TD private DRAM #933
• fix(migtd): propagate policy errors in SPDM rebinding path by @haitaohuang in fix(migtd): propagate policy errors in SPDM rebinding path #904
• fix(migtd): include TD_INFO in default metadata by @MichalTarnacki in fix(migtd): include TD_INFO in default metadata #896
• fix(migtd): fence insecure attestation test features from release builds by @MichalTarnacki in fix(migtd): fence insecure attestation test features from release builds #936
• fix(attestation): harden quote/report handling from security audit by @MichalTarnacki in fix(attestation): harden quote/report handling from security audit #951
• fix(crypto): TLS back-pressure and ecdsa error propagation from secur… by @MichalTarnacki in fix(crypto): TLS back-pressure and ecdsa error propagation from secur… #950
• build(deps): bump zerocopy from 0.8.52 to 0.8.53 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump zerocopy from 0.8.52 to 0.8.53 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #941
• docs(migtd): add AI assistance policy to CONTRIBUTING.md by @sgrams in docs(migtd): add AI assistance policy to CONTRIBUTING.md #953
• fix(vsock): packet/credit/dump validation from security audit by @MichalTarnacki in fix(vsock): packet/credit/dump validation from security audit #943
• fix(migtd): wipe migration key material from TLS and SPDM buffers by @MichalTarnacki in fix(migtd): wipe migration key material from TLS and SPDM buffers #934
• build(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @dependabot[bot] in build(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 #954
• build(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.0 by @dependabot[bot] in build(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.0 #959
• build(deps): bump github/codeql-action/autobuild from 4.36.2 to 4.37.0 by @dependabot[bot] in build(deps): bump github/codeql-action/autobuild from 4.36.2 to 4.37.0 #956
• build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.0 by @dependabot[bot] in build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.0 #955
• build(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 by @dependabot[bot] in build(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 #958
• build(deps): bump zerocopy from 0.8.53 to 0.8.54 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump zerocopy from 0.8.53 to 0.8.54 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #957
• build(deps): bump spin from 0.12.1 to 0.12.2 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump spin from 0.12.1 to 0.12.2 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #960
• build(deps): bump clap from 4.6.1 to 4.6.2 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump clap from 4.6.1 to 4.6.2 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #961
• build(deps): bump ubuntu from b7f4819 to 651ba3f in /container by @dependabot[bot] in build(deps): bump ubuntu from b7f4819 to 651ba3f in /container #962
• build(deps): bump dtolnay/rust-toolchain from fa04a1451ff1842e2626ccb99004d0195b455a88 to 2c7215f132e9ebf062739d9130488b56d53c060c by @dependabot[bot] in build(deps): bump dtolnay/rust-toolchain from fa04a1451ff1842e2626ccb99004d0195b455a88 to 2c7215f132e9ebf062739d9130488b56d53c060c #964
• build(deps): bump github/codeql-action/autobuild from 4.37.0 to 4.37.1 by @dependabot[bot] in build(deps): bump github/codeql-action/autobuild from 4.37.0 to 4.37.1 #963
• build(deps): bump github/codeql-action/init from 4.37.0 to 4.37.1 by @dependabot[bot] in build(deps): bump github/codeql-action/init from 4.37.0 to 4.37.1 #965
• build(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.1 by @dependabot[bot] in build(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.1 #968
• build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by @dependabot[bot] in build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 #966
• build(deps): bump bitflags from 2.13.0 to 2.13.1 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump bitflags from 2.13.0 to 2.13.1 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #969
• build(deps): bump serde from 1.0.228 to 1.0.229 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump serde from 1.0.228 to 1.0.229 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #974
• build(deps): bump tokio from 1.52.3 to 1.53.1 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump tokio from 1.52.3 to 1.53.1 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #975
• build(deps): bump zerocopy from 0.8.54 to 0.8.55 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump zerocopy from 0.8.54 to 0.8.55 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #973
• build(deps): bump ubuntu from 651ba3f to 3131b4c in /container by @dependabot[bot] in build(deps): bump ubuntu from 651ba3f to 3131b4c in /container #976
• build(deps): bump clap from 4.6.2 to 4.6.3 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump clap from 4.6.2 to 4.6.3 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #977
• build(deps): bump serde_json from 1.0.150 to 1.0.151 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump serde_json from 1.0.150 to 1.0.151 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #978
• build(deps): bump anyhow from 1.0.103 to 1.0.104 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump anyhow from 1.0.103 to 1.0.104 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #979
• fix(migtd/spdm): make ExchangeMigrationInfoReq one-shot by @psidor99 in fix(migtd/spdm): make ExchangeMigrationInfoReq one-shot #971
• fix(deps): apply security fixes to td-shim-AzCVMEmu by @MichalTarnacki in fix(deps): apply security fixes to td-shim-AzCVMEmu #932
• fix(pci): BAR sizing and MMIO bounds from security audit by @MichalTarnacki in fix(pci): BAR sizing and MMIO bounds from security audit #949
• virtio-serial driver bugfixes by @Martinits in virtio-serial driver bugfixes #817
• build(deps): bump clap from 4.6.3 to 4.6.4 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump clap from 4.6.3 to 4.6.4 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #980
• fix(migtd): implement security mitigations for memory safety findings by @MichalTarnacki in fix(migtd): implement security mitigations for memory safety findings #989
• fix(migtd/migration): restrict GetTDReport to emulation builds by @psidor99 in fix(migtd/migration): restrict GetTDReport to emulation builds #970
• build(deps): bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 by @dependabot[bot] in build(deps): bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 #983
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in build(deps): bump actions/checkout from 7.0.0 to 7.0.1 #984
• build(deps): bump EmbarkStudios/cargo-deny-action from 2.0.20 to 2.1.1 by @dependabot[bot] in build(deps): bump EmbarkStudios/cargo-deny-action from 2.0.20 to 2.1.1 #982
• fix(virtio/virtqueue): authenticate descriptor completions by @psidor99 in fix(virtio/virtqueue): authenticate descriptor completions #986
• ci: sync codeql-action steps to v4.37.3 and group in dependabot by @jyao1 in ci: sync codeql-action steps to v4.37.3 and group in dependabot #991
• fix(migtd): harden BAR handling, logging, and collateral fetches by @MichalTarnacki in fix(migtd): harden BAR handling, logging, and collateral fetches #939
• build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 #993
• build(deps): bump clap from 4.6.4 to 4.6.5 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump clap from 4.6.4 to 4.6.5 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #994
• build(deps): bump the codeql-action group with 4 updates by @dependabot[bot] in build(deps): bump the codeql-action group with 4 updates #992
• fix(virtio_serial): refuse to free the virtqueue ring pages by @MichalTarnacki in fix(virtio_serial): refuse to free the virtqueue ring pages #996
• fix(migtd): harden virtqueue, vsock, SPDM and policy against untruste… by @MichalTarnacki in fix(migtd): harden virtqueue, vsock, SPDM and policy against untruste… #935
• test(migtd): add regression test for ExchangeInformation wire layout by @kali834x in test(migtd): add regression test for ExchangeInformation wire layout #914
• build(deps): bump the codeql-action group with 4 updates by @dependabot[bot] in build(deps): bump the codeql-action group with 4 updates #998
• build(deps): bump dtolnay/rust-toolchain from 2c7215f132e9ebf062739d9130488b56d53c060c to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 by @dependabot[bot] in build(deps): bump dtolnay/rust-toolchain from 2c7215f132e9ebf062739d9130488b56d53c060c to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 #999
• build(deps): bump ubuntu from 3131b4c to 678c655 in /container by @dependabot[bot] in build(deps): bump ubuntu from 3131b4c to 678c655 in /container #995
• build(deps): update linux-sgx to sgx_2.30 by @sgrams in build(deps): update linux-sgx to sgx_2.30 #1000
• build(deps): bump clap from 4.6.5 to 4.6.6 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump clap from 4.6.5 to 4.6.6 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #1001
• build(deps): bump zerocopy from 0.8.55 to 0.8.56 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump zerocopy from 0.8.55 to 0.8.56 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #1002
• build(deps): bump the codeql-action group with 4 updates by @dependabot[bot] in build(deps): bump the codeql-action group with 4 updates #1005
• build(deps): bump step-security/harden-runner from 2.20.0 to 2.20.1 by @dependabot[bot] in build(deps): bump step-security/harden-runner from 2.20.0 to 2.20.1 #1006
• Revert "fix(migtd/migration): restrict GetTDReport to emulation builds" by @sgrams in Revert "fix(migtd/migration): restrict GetTDReport to emulation builds" #1004
• build(deps): bump ubuntu from 678c655 to 2260313 in /container by @dependabot[bot] in build(deps): bump ubuntu from 678c655 to 2260313 in /container #1007
• build(deps): bump the codeql-action group with 4 updates by @dependabot[bot] in build(deps): bump the codeql-action group with 4 updates #1008
• build(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 by @dependabot[bot] in build(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 #1009
• build(deps): bump spin from 0.12.2 to 0.12.3 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump spin from 0.12.2 to 0.12.3 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #1010
• fix(policy): reject non-canonical TCB date in policy v2 compare by @MichalTarnacki in fix(policy): reject non-canonical TCB date in policy v2 compare #937
• fix(migtd): input validation and robustness from security audit by @MichalTarnacki in fix(migtd): input validation and robustness from security audit #942
• chore(migtd): upgrade version to 0.7.2 by @sgrams in chore(migtd): upgrade version to 0.7.2 #1013
• fix(sh_script): create target/release before linking/enrolling images by @mpojmaj in fix(sh_script): create target/release before linking/enrolling images #1014
• build(deps): bump the codeql-action group with 4 updates by @dependabot[bot] in build(deps): bump the codeql-action group with 4 updates #1015
• build(deps): bump log from 0.4.33 to 0.4.34 in /deps/td-shim-AzCVMEmu/azcvm-extract-report by @dependabot[bot] in build(deps): bump log from 0.4.33 to 0.4.34 in /deps/td-shim-AzCVMEmu/azcvm-extract-report #1011
• fix(migtd): add TD_INFO compatibility build mode by @MichalTarnacki in fix(migtd): add TD_INFO compatibility build mode #1017
• fix(vsock): remove redundant buffer check by @mpojmaj in fix(vsock): remove redundant buffer check #1019
• fix(Cargo.lock): upgrade quinn-proto to resolve GHSA-4w2j-m93h-cj5j by @sgrams in fix(Cargo.lock): upgrade quinn-proto to resolve GHSA-4w2j-m93h-cj5j #1020
• fix(migtd/spdm): reject zero-progress transport I/O by @haitaohuang in fix(migtd/spdm): reject zero-progress transport I/O #1022
• build(azcvm-extract-report): bump dependencies by @haitaohuang in build(azcvm-extract-report): bump dependencies #1023
• fix(sh_script): update migtd_attr in user-td.sh by @mpojmaj in fix(sh_script): update migtd_attr in user-td.sh #1025

New Contributors

• @psidor99 made their first contribution in fix(migtd/spdm): make ExchangeMigrationInfoReq one-shot #971
• @Martinits made their first contribution in virtio-serial driver bugfixes #817
• @kali834x made their first contribution in test(migtd): add regression test for ExchangeInformation wire layout #914

Full Changelog: v0.7.1...v0.7.2

---

This discussion was created from the release MigTD v0.7.2 Release.