Denial of Service Vulnerability in Intel Microcode Package
Summary
ALPINE-CVE-2025-21090: Missing reference to active allocated resource for some Intel(R) Xeon(R) processors may allow an authenticated user to potentially enable denial of service via local access. Affects intel-ucode versions < 20250812-r0. Fixed in 20250812-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The intel-ucode package is a critical component in Alpine Linux distributions, providing microcode updates for Intel processors. These updates are essential for maintaining the stability and security of Intel CPUs, particularly for Xeon processors used in server environments. The package ensures that the processors operate efficiently and securely by applying necessary updates that address hardware-level issues.
Vulnerability Detail
The vulnerability identified as ALPINE-CVE-2025-21090 stems from a missing reference to an active allocated resource for certain Intel Xeon processors. This oversight can potentially allow an authenticated user to trigger a denial of service (DoS) condition through local access. The issue arises from improper handling of resources, which may lead to system instability or crashes, affecting the overall performance and reliability of systems utilizing the affected microcode.
How To Fix
Minimum fixed version
20250812-r0
This is the first release that contains the fix.
sudo apk add --upgrade intel-ucodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate any potential risks.
Conclusion
The ALPINE-CVE-2025-21090 vulnerability in the intel-ucode package poses a significant risk of denial of service for users of affected Alpine Linux versions. It is essential to update to the patched version to ensure system stability and security.
See every vulnerability recorded for intel-ucode →
FAQ
The vulnerability may allow an authenticated user to cause a denial of service, potentially leading to system crashes or instability.
Users of Alpine Linux versions 3.19, 3.20, 3.21, and 3.22 that utilize the intel-ucode package on affected Intel Xeon processors are at risk.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, a patch is available in the form of the updated intel-ucode package version 20250812-r0.
While there are no specific workarounds, it is crucial to monitor the situation and apply the patch as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for intel-ucode.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
