Information Disclosure Vulnerability in Intel Microcode Package
Summary
ALPINE-CVE-2025-20012: Incorrect behavior order for some Intel(R) Core™ Ultra Processors may allow an unauthenticated user to potentially enable information disclosure via physical access. Affects intel-ucode versions < 20250512-r0. Fixed in 20250512-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Intel microcode package (intel-ucode) is essential for the proper functioning of Intel processors, providing updates that enhance performance and security. It is critical for maintaining system stability and addressing hardware-level issues. This package is particularly important for users of Intel Core Ultra Processors, as it ensures that the processors operate as intended and are protected against known vulnerabilities.
Vulnerability Detail
The vulnerability identified as ALPINE-CVE-2025-20012 arises from an incorrect behavior order in some Intel Core Ultra Processors. This flaw may allow an unauthenticated user to potentially disclose sensitive information through physical access to the device. The vulnerability poses a significant risk as it could lead to unauthorized access to confidential data, making it imperative for users to address this issue promptly.
How To Fix
Minimum fixed version
20250512-r0
This is the first release that contains the fix.
sudo apk add --upgrade intel-ucodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The ALPINE-CVE-2025-20012 vulnerability poses a serious risk to users of Intel Core Ultra Processors due to potential information disclosure. It is essential to update the intel-ucode package to the fixed version to protect against this vulnerability. Users are encouraged to utilize tools like Vulert to monitor their systems for vulnerabilities.
See every vulnerability recorded for intel-ucode →
FAQ
The vulnerability is related to an incorrect behavior order in Intel Core Ultra Processors that may allow information disclosure.
Users of Intel Core Ultra Processors running the affected versions of the intel-ucode package are at risk.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, a patch is available in the form of the intel-ucode package version 20250512-r0.
While there are no specific workarounds, it is crucial to prioritize updating the package as soon as possible to mitigate the risk of information disclosure.
References
Related vulnerabilities
Recent vulnerabilities recorded for intel-ucode.
