Privilege Escalation Vulnerability in Intel Microcode Packages
Summary
UBUNTU-CVE-2025-24305: Insufficient control flow management in the Alias Checking Trusted Module (ACTM) firmware for some Intel(R) Xeon(R) processors may allow a privileged user to potentially enable escalation of privilege via local access. Affects intel-microcode versions 1.20130906.1ubuntu2 – 3.20210608.0ubuntu0.14.04.1+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Intel Microcode is a critical component that updates the internal instructions of Intel processors, enhancing performance and security. The affected versions of the intel-microcode package are used in various Ubuntu LTS distributions, including 14.04, 16.04, 18.04, 20.04, 22.04, 24.04, and 25.04. This vulnerability exposes systems to potential privilege escalation attacks, allowing unauthorized users to gain elevated access.
Vulnerability Detail
Insufficient control flow management in the Alias Checking Trusted Module (ACTM) firmware for some Intel Xeon processors may allow a privileged user to potentially enable escalation of privilege via local access. This vulnerability arises from flaws in the microcode that could be exploited to gain unauthorized access to system resources, leading to severe security implications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, limit physical access to systems running the affected versions of the intel-microcode package to prevent unauthorized users from exploiting this vulnerability.
Conclusion
The privilege escalation vulnerability in the intel-microcode package poses significant risks to systems running affected versions of Ubuntu. It is crucial to update to the latest patched versions to mitigate these risks and ensure system security.
See every vulnerability recorded for intel-microcode →
FAQ
The CVSS score of this vulnerability is 7.2, indicating a high level of severity.
The affected versions include Ubuntu 14.04, 16.04, 18.04, 20.04, 22.04, 24.04, and 25.04.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update the package immediately, ensure to restrict physical access to the systems to mitigate the risk of exploitation.
The potential consequences include unauthorized privilege escalation, which could lead to data breaches, system compromise, and loss of integrity.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
