{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-22047", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.810Z", "datePublished": "2025-04-16T14:12:07.061Z", "dateUpdated": "2026-08-05T11:56:19.652Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:56:19.652Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/microcode/AMD: Fix __apply_microcode_amd()'s return value\n\nWhen verify_sha256_digest() fails, __apply_microcode_amd() should propagate\nthe failure by returning false (and not -1 which is promoted to true)." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The microcode loader is reached only locally — via the initrd/builtin blob at boot, CPU hotplug/resume, or a write to `/sys/devices/system/cpu/microcode/reload`; there is no network-reachable path, and the resulting unmitigated-CPU exposure is exploited by local code.\nAC:L - The wrong return value is deterministic — every microcode blob whose SHA256 digest is not in the kernel's hardcoded `phashes[]` table takes the buggy path with 100% reliability, with no race, timing window, or memory-layout dependency.\nPR:L - The vulnerable state (forged `boot_cpu_data.microcode`, cleared Zenbleed chicken bit, false \"updated\" report) is produced by ordinary unattended microcode loading, so an attacker needs no more than an unprivileged local account to then exploit the CPU errata that the kernel wrongly believes are fixed.\nUI:N - No victim action is required — early loading from initrd runs on every boot and `load_ucode_amd_ap()`/`mc_bp_resume()` run on every CPU bring-up and resume, all automatically.\nS:U - The defeated integrity check, the corrupted `boot_cpu_data.microcode` state and the mis-set `MSR_AMD64_DE_CFG` chicken bit all live within the host kernel/CPU security authority; no VMM or IOMMU boundary is crossed by the flaw itself.\nC:H - Clearing `MSR_AMD64_DE_CFG_ZEN2_FP_BACKUP_FIX_BIT` on the basis of a forged revision re-enables Zenbleed (CVE-2023-20593), giving unprivileged local code a cross-process/cross-VM read of register contents including keys and passwords, and the un-applied blob also carries speculative-execution mitigations.\nI:H - An attacker/blob-controlled 32-bit `hdr.patch_id` is written unverified into kernel security state (`boot_cpu_data.microcode`, `c->microcode`, cpuinfo), and that value directly drives modification of a hardware protection mechanism via `msr_clear_bit()` — a full bypass of the integrity check the code exists to enforce.\nA:H - The kernel reports a successful update while the CPU keeps running old microcode, so errata that AMD patches fix — including hang- and machine-check-inducing ones and the erratum 1386 XSAVES malfunction gated on the forged revision — remain live with no signal to the operator." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/kernel/cpu/microcode/amd.c" ], "versions": [ { "version": "bef830144febedb7de86863ae99d8f53bed76e95", "lessThan": "763f4d638f71cb45235395790a46e9f9e84227fd", "status": "affected", "versionType": "git" }, { "version": "3e8653e399e7111a3e87d534ff4533b250ae574f", "lessThan": "ada88219d5315fc13f2910fe278c7112d8d68889", "status": "affected", "versionType": "git" }, { "version": "c162ba4f45ab6ef3b7114af6fb419f1833f050c0", "lessThan": "d295c58fad1d5ab987a81f139dd21498732c4f13", "status": "affected", "versionType": "git" }, { "version": "50cef76d5cb0e199cda19f026842560f6eedc4f7", "lessThan": "7f705a45f130a85fbf31c2abdc999c65644c8307", "status": "affected", "versionType": "git" }, { "version": "50cef76d5cb0e199cda19f026842560f6eedc4f7", "lessThan": "31ab12df723543047c3fc19cb8f8c4498ec6267f", "status": "affected", "versionType": "git" }, { "version": "6.6.81", "lessThan": "6.6.87", "status": "affected", "versionType": "semver" }, { "version": "6.12.18", "lessThan": "6.12.23", "status": "affected", "versionType": "semver" }, { "version": "6.13.6", "lessThan": "6.13.11", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/kernel/cpu/microcode/amd.c" ], "versions": [ { "version": "6.14", "status": "affected" }, { "version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.87", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.23", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.11", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.2", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.81", "versionEndExcluding": "6.6.87" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.18", "versionEndExcluding": "6.12.23" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13.6", "versionEndExcluding": "6.13.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.14.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/763f4d638f71cb45235395790a46e9f9e84227fd" }, { "url": "https://git.kernel.org/stable/c/ada88219d5315fc13f2910fe278c7112d8d68889" }, { "url": "https://git.kernel.org/stable/c/d295c58fad1d5ab987a81f139dd21498732c4f13" }, { "url": "https://git.kernel.org/stable/c/7f705a45f130a85fbf31c2abdc999c65644c8307" }, { "url": "https://git.kernel.org/stable/c/31ab12df723543047c3fc19cb8f8c4498ec6267f" } ], "title": "x86/microcode/AMD: Fix __apply_microcode_amd()'s return value", "x_generator": { "engine": "bippy-1.2.0" } } } }