Intel Microarchitectural Predictor State Vulnerability in intel-ucode Package
Summary
ALPINE-CVE-2025-20623: Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel(R) Core™ processors (10th Generation) may allow an authenticated user to potentiall... Affects intel-ucode versions < 20250512-r0. Fixed in 20250512-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The intel-ucode package provides microcode updates for Intel processors, enhancing their performance and security. It is crucial for maintaining system stability and security, especially for systems running on Intel Core processors. However, certain versions of this package are vulnerable to a specific issue that can lead to information disclosure.
Vulnerability Detail
The vulnerability, identified as ALPINE-CVE-2025-20623, stems from the exposure of sensitive information due to shared microarchitectural predictor state in some Intel Core processors (10th Generation). This flaw allows an authenticated user to potentially enable information disclosure via local access, posing a significant risk to data integrity and confidentiality.
How To Fix
Minimum fixed version
20250512-r0
This is the first release that contains the fix.
sudo apk add --upgrade intel-ucodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, limit local access to systems running vulnerable versions of the intel-ucode package until the package can be updated. This can be achieved by adjusting user permissions and access controls.
Conclusion
The intel-ucode package has a critical vulnerability that could lead to information disclosure in certain Intel processors. It is essential to update to the patched version to mitigate this risk. Users are encouraged to monitor their systems and apply the necessary updates promptly.
See every vulnerability recorded for intel-ucode →
FAQ
The vulnerability allows for potential information disclosure due to shared microarchitectural predictor state in certain Intel processors.
The affected versions include those prior to the patched version 20250512-r0 across Alpine versions v3.18 to v3.22.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could lead to unauthorized access to sensitive information, compromising data security.
Yes, updating to the patched version 20250512-r0 of the intel-ucode package is the recommended permanent fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for intel-ucode.
