Privilege Escalation Vulnerability in Intel Microcode Package
Summary
UBUNTU-CVE-2025-22840: Sequence of processor instructions leads to unexpected behavior for some Intel(R) Xeon(R) 6 Scalable processors may allow an authenticated user to potentially enable escalation of privilege via local access. Affects intel-microcode versions 1.20130906.1ubuntu2 – 3.20210608.0ubuntu0.14.04.1+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Intel Microcode package is essential for the proper functioning of Intel processors, providing updates and fixes to the processor's firmware. It plays a critical role in enhancing the performance and security of systems running on Intel hardware. However, certain versions of this package are vulnerable to a privilege escalation issue that could potentially allow authenticated users to gain elevated access to system resources.
Vulnerability Detail
A sequence of processor instructions in some Intel(R) Xeon(R) 6 Scalable processors can lead to unexpected behavior, allowing an authenticated user to escalate privileges via local access. This vulnerability stems from the way the microcode interacts with the processor's instruction set, which can be exploited to bypass security mechanisms, potentially compromising system integrity and confidentiality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit access to systems running vulnerable versions of the Intel Microcode package to trusted personnel only, thereby reducing the risk of exploitation until a patch is applied.
Conclusion
The Intel Microcode package has a critical vulnerability that could allow privilege escalation for authenticated users. It is essential to update to the latest patched version to mitigate risks. Users should also consider using tools like Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for intel-microcode →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
Affected versions include those in Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and 25.04.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow an authenticated user to gain elevated privileges, potentially compromising sensitive data and system integrity.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
