USN-7535-1: intel-microcode vulnerabilities

Q: Who could exploit these issues?

The issues require an authenticated attacker. The disclosed impacts include obtaining sensitive information and, for some CVEs, causing a denial of service.

Q: What types of impact are described?

Several issues may allow sensitive information disclosure through transient-execution, prediction-calculation, or branch-prediction resource handling. CVE-2025-20054 and CVE-2025-20103 may allow denial of service through core management mechanism handling.

Q: Which component should be reviewed for remediation?

Review the intel-microcode package on Ubuntu systems. The notice applies to Intel processors affected by the described microarchitectural handling issues.

Published May 27, 2025

Updated

Sander Wiebing and Cristiano Giuffrida discovered that some Intel® Processors did not properly handle data in Shared Microarchitectural Structures during Transient Execution. An authenticated attacker could possibly use this issue to obtain sensitive information. (CVE-2024-28956)

It was discovered that some Intel® Processors did not properly handle prediction calculations. An authenticated attacker could possibly use this issue to obtain sensitive information. (CVE-2024-43420, CVE-2024-45332, CVE-2025-20623)

It was discovered that some Intel® Processors did not properly initialize resources in the branch prediction unit. An authenticated attacker could possibly use this issue to obtain sensitive information. (CVE-2025-20012, CVE-2025-24495)

Michal Raviv and Jeff Gilbert discovered that some Intel® Processors did not properly handle resources and exceptions in the core management mechanism. An authenticated attacker could possibly use this issue to cause a denial of service. (CVE-2025-20054, CVE-2025-20103)

Affected Software

19 affected componentsFixes available

ubuntu/intel-microcode<3.20250512.0ubuntu0.16.04.1+esm1

3.20250512.0ubuntu0.16.04.1+esm1

ubuntu/intel-microcode<3.20250512.0ubuntu0.18.04.1+esm1

3.20250512.0ubuntu0.18.04.1+esm1

ubuntu/intel-microcode<3.20250512.0ubuntu0.20.04.1

3.20250512.0ubuntu0.20.04.1

ubuntu/intel-microcode<3.20250512.0ubuntu0.22.04.1

3.20250512.0ubuntu0.22.04.1

ubuntu/intel-microcode<3.20250512.0ubuntu0.24.04.1

3.20250512.0ubuntu0.24.04.1

All of the following

ubuntu/intel-microcode<3.20250512.0ubuntu0.25.04.1

3.20250512.0ubuntu0.25.04.1

Ubuntu Ubuntu=25.04

All of the following

ubuntu/intel-microcode<3.20250512.0ubuntu0.24.10.1

3.20250512.0ubuntu0.24.10.1

Ubuntu Ubuntu=24.10

All of the following

ubuntu/intel-microcode<3.20250512.0ubuntu0.24.04.1

3.20250512.0ubuntu0.24.04.1

Ubuntu Ubuntu=24.04

All of the following

ubuntu/intel-microcode<3.20250512.0ubuntu0.22.04.1

3.20250512.0ubuntu0.22.04.1

Ubuntu Ubuntu=22.04

All of the following

ubuntu/intel-microcode<3.20250512.0ubuntu0.20.04.1

3.20250512.0ubuntu0.20.04.1

Ubuntu Ubuntu=20.04

All of the following

ubuntu/intel-microcode<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/intel-microcode<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=16.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20250512.0ubuntu0.16.04.1+esm1
Upgrade
Upgrade ubuntu/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20250512.0ubuntu0.18.04.1+esm1
Upgrade
Upgrade ubuntu/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20250512.0ubuntu0.20.04.1
Upgrade
Upgrade ubuntu/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20250512.0ubuntu0.22.04.1
Upgrade
Upgrade ubuntu/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20250512.0ubuntu0.24.04.1
Upgrade
Upgrade ubuntu/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20250512.0ubuntu0.25.04.1
Upgrade
Upgrade ubuntu/intel-microcode to a version that resolves this vulnerability.
Fixed in 3.20250512.0ubuntu0.24.10.1
Upgrade
Upgrade ubuntu/intel-microcode to a version that resolves this vulnerability.
Fixed in Ubuntu Pro

Event History

May 27, 2025

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Advisory Published

via OSV·12:21 PM

Data Sourced

via OSV·12:21 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Who could exploit these issues?

The issues require an authenticated attacker. The disclosed impacts include obtaining sensitive information and, for some CVEs, causing a denial of service.

What types of impact are described?

Several issues may allow sensitive information disclosure through transient-execution, prediction-calculation, or branch-prediction resource handling. CVE-2025-20054 and CVE-2025-20103 may allow denial of service through core management mechanism handling.

Which component should be reviewed for remediation?

Review the intel-microcode package on Ubuntu systems. The notice applies to Intel processors affected by the described microarchitectural handling issues.

USN-7535-1: intel-microcode vulnerabilities

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who could exploit these issues?

What types of impact are described?

Which component should be reviewed for remediation?

Company

Resources

Contact

Frequently Asked Questions

Who could exploit these issues?

What types of impact are described?

Which component should be reviewed for remediation?