Intel(R) Core™ Ultra Processors Vulnerability in intel-ucode Package - Information Disclosure Risk
Summary
ALPINE-CVE-2025-24495: Incorrect initialization of resource in the branch prediction unit for some Intel(R) Core™ Ultra Processors may allow an authenticated user to potentially enable information disclosure via local access. Affects intel-ucode versions < 20250512-r0. Fixed in 20250512-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The intel-ucode package is essential for providing microcode updates to Intel processors, ensuring optimal performance and security. It plays a critical role in managing the low-level operations of Intel CPUs, including bug fixes and enhancements. However, vulnerabilities in this package can expose systems to significant risks, particularly in environments where sensitive data is processed.
Vulnerability Detail
The vulnerability identified as ALPINE-CVE-2025-24495 stems from incorrect initialization of resources in the branch prediction unit of certain Intel(R) Core™ Ultra Processors. This flaw may allow an authenticated user to potentially enable information disclosure via local access. The implications of this vulnerability can lead to unauthorized access to sensitive information, making it crucial for users to address it promptly.
How To Fix
Minimum fixed version
20250512-r0
This is the first release that contains the fix.
sudo apk add --upgrade intel-ucodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The ALPINE-CVE-2025-24495 vulnerability in the intel-ucode package poses a significant risk of information disclosure for users of Intel(R) Core™ Ultra Processors. It is essential to update to the patched version 20250512-r0 to mitigate this risk and ensure the security of your systems.
See every vulnerability recorded for intel-ucode →
FAQ
The vulnerability involves incorrect initialization in the branch prediction unit of Intel processors, which could lead to information disclosure.
Users of Intel(R) Core™ Ultra Processors running the affected versions of the intel-ucode package are at risk.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is advisable to monitor your system for any suspicious activity and apply the update as soon as possible.
Detailed information can be found in the CVE report for ALPINE-CVE-2025-24495, which outlines the vulnerability and its implications.
References
Related vulnerabilities
Recent vulnerabilities recorded for intel-ucode.
