Denial of Service Vulnerability in Intel Microcode Package
Summary
ALPINE-CVE-2025-20054: Uncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access. Affects intel-ucode versions < 20250512-r0. Fixed in 20250512-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The intel-ucode package is essential for providing microcode updates to Intel processors, ensuring optimal performance and security. It serves as a bridge between the operating system and the hardware, enabling the application of critical updates that enhance system stability and security. However, vulnerabilities in this package can expose systems to significant risks, including denial of service attacks.
Vulnerability Detail
The vulnerability identified as ALPINE-CVE-2025-20054 arises from an uncaught exception in the core management mechanism for certain Intel processors. This flaw allows an authenticated user to potentially trigger a denial of service condition through local access. The implications of this vulnerability are severe, as it can disrupt system operations and compromise the availability of services reliant on the affected processors.
How To Fix
Minimum fixed version
20250512-r0
This is the first release that contains the fix.
sudo apk add --upgrade intel-ucodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
The ALPINE-CVE-2025-20054 vulnerability poses a significant risk to systems utilizing the intel-ucode package, potentially leading to denial of service. Users are strongly advised to update to the patched version 20250512-r0 to safeguard their systems. Regular monitoring and prompt updates are essential to maintain system integrity.
See every vulnerability recorded for intel-ucode →
FAQ
The vulnerability is an uncaught exception in the core management mechanism for Intel processors, which can lead to denial of service.
Users of the intel-ucode package on Alpine Linux versions 3.18 to 3.22 are affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
While there are no specific workarounds, it is crucial to prioritize the update to mitigate the risk of denial of service.
Further details can be found in the CVE report at https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2025-20054.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for intel-ucode.
