SB2025070179 - Red Hat Enterprise Linux 9 update for microcode_ctl 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025070179

SB2025070179 - Red Hat Enterprise Linux 9 update for microcode_ctl

Published: July 1, 2025

Security Bulletin ID SB2025070179
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

High 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Missing initialization of resource (CVE-ID: CVE-2025-24495)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to incorrect initialization of resource in the branch prediction unit. A local user can gain unauthorized access to sensitive information on the system.


2) Incorrect behavior order (CVE-ID: CVE-2025-20012)

The vulnerability allows a local attacker to gain access to sensitive information on the system. The vulnerability exists due to incorrect behavior order. An attacker with physical access can disclose sensitive information on the target system.

3) Resource management error (CVE-ID: CVE-2024-28956)

The vulnerability allows a malicious guest to escalate privileges on the system.

The vulnerability exists due to an error in the hardware support for prediction-domain isolation dubbed "Indirect Target Selection". A malicious guest can infer the contents of arbitrary host memory, including memory assigned to other guests.


Remediation

Install update from vendor's website.

References