Information Disclosure Vulnerability in Intel Microcode Packages
Summary
CVE-2025-20012: Incorrect behavior order for some Intel(R) Core™ Ultra Processors may allow an unauthenticated user to potentially enable information disclosure via physical access. Affects intel-ucode versions < 20250512-r0. Fixed in 20250512-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Intel microcode is a critical component of Intel processors that provides updates to the processor's firmware, enhancing performance and security. It plays a vital role in ensuring the stability and reliability of systems that utilize Intel processors. The vulnerability in question affects several Debian versions (11, 12, and 13) of the intel-microcode package, which is essential for maintaining optimal processor functionality.
Vulnerability Detail
The vulnerability, identified as CVE-2025-20012, arises from an incorrect behavior order in some Intel Core Ultra Processors. This flaw may allow an unauthenticated user with physical access to the system to potentially enable information disclosure. The implications of this vulnerability are significant, as it could lead to unauthorized access to sensitive information stored on the affected systems, posing a serious security risk.
How To Fix
Minimum fixed version
20250512-r0
This is the first release that contains the fix.
sudo apk add --upgrade intel-ucodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As of now, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the necessary updates as soon as they become available.
Conclusion
CVE-2025-20012 represents a serious security risk for systems using Intel Core Ultra Processors, particularly those running the intel-microcode package on Debian. Users are strongly advised to update their packages promptly to protect against potential information disclosure.
See every vulnerability recorded for intel-ucode →
FAQ
CVE-2025-20012 is a vulnerability in Intel Core Ultra Processors that may allow information disclosure to an unauthenticated user with physical access.
The vulnerability affects the intel-microcode package across Debian versions 11, 12, and 13.
You can use the Vulert platform to check if your application is affected by this vulnerability without requiring any installation. Visit Vulert Scanner for more details.
While there are no specific workarounds, it is crucial to prioritize updating the package as soon as possible to mitigate the risk.
Yes, an attacker would need physical access to the system to exploit this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for intel-ucode.
