The vulnerability in ultravioletrs cocos (<=0.8.2) affects the Intel TDX verification path in the intra-handshake attested TLS (aTLS) process. Specifically, the expected current-session freshness value is not copied into the TDX quote-body policy before quote validation. As a result, the system accepts TDX QuoteV4 Evidence that is structurally valid but whose REPORT_DATA field does not match the expected reportData for the current session. This flaw allows a relying party to accept evidence with mismatched or reused reportData, potentially causing session misbinding to an unintended attestation context. The vulnerability is resolved in version 0.9.0.

An attacker can exploit this vulnerability to cause session misbinding by presenting attestation evidence that does not correspond to the current session. This can lead to unauthorized release of application data after the handshake, compromising confidentiality and integrity. The CVSS 3.1 base score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality and integrity impact with no availability impact.

Upgrade ultravioletrs cocos to version 0.9.0 or later, where this vulnerability is fixed. No other mitigation is indicated or required according to the available data.