Security: Disk encryption disableable via kernel cmdline, not measured in RTMR #618

Activity

1. kvinwang commented on Mar 27, 2026

   

   kvinwang

   on Mar 27, 2026

   Last edited by kvinwang

   CollaboratorAuthor

   More actions

   Maintainer response (copied from private security advisory GHSA-jwpv-vw5q-rj47):

   Thank you for the report!

   Here is our analysis:

   1. The kernel command line IS measured — in RTMR2, not RTMR3

   The advisory states that storage_encrypted is "NOT extended into RTMR3" and therefore not detectable by remote attestation. While it's true that there is no RTMR3 runtime event for storage_encrypted, the advisory overlooks that the entire kernel command line is measured into RTMR2 by the Linux EFI stub.

   In TDX, PCR 9 maps to RTMR[2]. The Linux EFI stub measures the full kernel cmdline (as UTF-16LE) into PCR 9 before the kernel proper starts executing. The dstack-mr tool pre-computes the expected RTMR2 value from the known cmdline:

   // dstack-mr/src/machine.rs
   let rtmr2_log = vec![
       kernel::measure_cmdline(self.kernel_cmdline),
       measure_sha384(&initrd_data),
   ];
   let rtmr2 = measure_log(&rtmr2_log);

   Adding dstack.storage_encrypted=false to the cmdline changes the cmdline string, which changes RTMR2, which changes mr_aggregated. A remote verifier comparing against expected measurements will detect this immediately.

   2. Standard deployments don't include storage_encrypted in the cmdline at all

   In the standard dstack image build (mkimage.sh), the kernel cmdline is:

   console=ttyS0 init=/init panic=1 ... dstack.rootfs_hash=<HASH> dstack.rootfs_size=<SIZE>
   

   There is no dstack.storage_encrypted parameter. The code in parse_dstack_options() defaults to storage_encrypted: true. The VMM constructs the QEMU command from metadata.json — there is no mechanism for an operator to inject extra cmdline args through the VMM API.

   If a host operator bypasses the VMM and manually modifies the QEMU -append argument, the changed cmdline is measured into RTMR2, making it detectable.

   Summary

   Claim	Reality
   storage_encrypted not measured in RTMR	Measured in RTMR2 as part of the kernel cmdline
   Verifiers cannot detect disabled encryption	RTMR2 change is reflected for the changes
   Host operator can disable encryption silently	Changing cmdline changes RTMR2; bypassing VMM also changes measurements
2. kvinwang

   closed this as completedon Mar 27, 2026
3. h4x3rotab

   added

   securitySecurity-related issue, report, or hardening workSecurity-related issue, report, or hardening work

   security: reportPublic security report or already-public security findingPublic security report or already-public security finding

   security: not-production-vulnDoes not compromise supported production deployments under the documented threat modelDoes not compromise supported production deployments under the documented threat model

   on Jun 30, 2026
4. kvinwang

   added a commit that references this issue on Sep 23, 2026

   feat(dstack-util): measure whether the data disk was encrypted

   ...

   866dec1