Intel Microcode Vulnerability: Information Disclosure Risk in Intel Core Ultra Processors
Summary
UBUNTU-CVE-2025-24495: Incorrect initialization of resource in the branch prediction unit for some Intel(R) Core™ Ultra Processors may allow an authenticated user to potentially enable information disclosure via local access. Affects intel-microcode versions 1.20130906.1ubuntu2 – 3.20210608.0ubuntu0.14.04.1+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'intel-microcode' package provides microcode updates for Intel processors, enhancing their performance and security. It is critical for maintaining system stability and security, as it addresses hardware-level vulnerabilities. This package is particularly important for systems running on Ubuntu LTS versions, ensuring that Intel processors operate efficiently and securely.
Vulnerability Detail
The vulnerability identified as CVE-2025-24495 stems from incorrect initialization of resources in the branch prediction unit of certain Intel Core Ultra Processors. This flaw could allow an authenticated user to potentially enable information disclosure via local access. The implications of this vulnerability are significant, as it could lead to unauthorized access to sensitive information stored in the system, thereby compromising user privacy and data integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can limit access to the system to trusted individuals only, thereby reducing the risk of exploitation. Additionally, monitoring system logs for unusual activity may help in identifying potential attempts to exploit this vulnerability.
Conclusion
The intel-microcode vulnerability CVE-2025-24495 poses a significant risk of information disclosure for users of affected Intel Core Ultra Processors. It is crucial to update the package to the latest version to mitigate this risk. Users are encouraged to monitor their systems and limit access until the update can be applied.
See every vulnerability recorded for intel-microcode →
FAQ
CVE-2025-24495 is a vulnerability in the intel-microcode package that affects certain Intel Core Ultra Processors, allowing potential information disclosure.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability may allow authenticated users to access sensitive information, posing a risk to user privacy and data security.
Yes, a patched version of the intel-microcode package is available. Users should update to version 3.20250512.0ubuntu0.20.04.1 or later.
If immediate updates are not possible, limit system access to trusted users and monitor for any unusual activity as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for intel-microcode.
