CVE-2025-20054: Medium severity debian/intel-microcode vulnerability

Published May 13, 2025

Updated

Uncaught exception in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access.

Affected Software

1 affected componentFixes available

debian/intel-microcode

3.20251111.1~deb12u13.20250812.1~deb12u13.20251111.1~deb13u13.20250812.1~deb13u13.20260227.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20251111.1~deb12u1Fixed in 3.20250812.1~deb12u1Fixed in 3.20251111.1~deb13u1Fixed in 3.20250812.1~deb13u1Fixed in 3.20260227.1

Event History

May 13, 2025

CVE Published

via MITRE·09:01 PM

Data Sourced

via MITRE·09:01 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

DSA-5924

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4170-1

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to be authenticated and have local access. The CVSS vector indicates low attack complexity and low privileges are required, with no user interaction needed.

What is the expected security impact?

The reported impact is denial of service. The CVSS vector indicates no confidentiality or integrity impact, but availability impact is high and the scope is changed.