SB2025051436 - Multiple vulnerabilities in Intel Core Ultra Processors

Description

This security bulletin contains information about 2 vulnerabilities.

1) Missing initialization of resource (CVE-ID: CVE-2025-24495)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to incorrect initialization of resource in the branch prediction unit. A local user can gain unauthorized access to sensitive information on the system.

2) Incorrect behavior order (CVE-ID: CVE-2025-20012)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to gain access to sensitive information on the system. The vulnerability exists due to incorrect behavior order. An attacker with physical access can disclose sensitive information on the target system.

Remediation

Install update from vendor's website.

References

• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01322.html