Intel Xeon Firmware Vulnerabilities (INTEL-SA-01313): CVE-2025-20063/24395/21090 Advisory

Key Information Vulnerability Overview Intel ID: INTEL-SA-01313 Severity Category: Arbitrary Code Execution, Privilege Escalation Impact: Privilege Escalation, Denial of Service Security Rating: 4.6/9 Original Release Date: July 18, 2023 Last Updated Date: July 18, 2023 Vulnerability Details CVE-2025-20063: - Description: In certain Intel Xeon processors with SGX-enabled firmware, improper input validation may allow privileged users to bypass restrictions, potentially enabling access to other resources. - CVSS Base Score: 3.1 / 7.2 High - CVSS Vector 3.1: - CVSS Vector 4.0: CVE-2025-24395: - Description: In certain Intel Xeon processors' Active Checking Trusted Module (ACTM) firmware, improper control flow management may allow privileged users to potentially manipulate prior execution via local access. - CVSS Base Score: 3.1 / 7.2 High - CVSS Vector 3.1: - CVSS Vector 4.0: CVE-2025-21090: - Description: Improper handling of active resource references in certain Intel Xeon processors may allow authenticated users to potentially cause service disruption via local access. - CVSS Base Score: 3.1 / 6.5 Medium - CVSS Vector 3.1: - CVSS Vector 4.0: Affected Products 5th Gen Intel Xeon Scalable Processors - Vertical Segment: Server - CPU ID: CNR2, H7 - Platform ID: N/A 5th Gen Intel Xeon Scalable Processors - Vertical Segment: Server, Network and Edge - CPU ID: BRS7, B7 - Platform ID: D4 Intel Xeon W2100 and W3100 Processors - Vertical Segment: Server, Workstation - CPU ID: B0F8 - Platform ID: 87 Intel Xeon 6 Processor Family - Vertical Segment: Server - CPU ID: AB1B0, 95 - Platform ID: AB1B0, AB1BT Intel Xeon 6 Processors with ExaScale - Vertical Segment: Server - CPU ID: ADPE - Platform ID: N/A Recommended Actions Intel recommends that users of affected Intel Xeon processors update to the latest firmware versions provided by their system manufacturers to address these issues. Acknowledgments These vulnerabilities were discovered internally by Intel employees. Intel thanks Joseph Nutman (CVE-2025-21090), Brian Gross (CVE-2025-20063), and Shmuel Tzurong (CVE-2025-24395) for their contributions.

Goal Reached Thanks to every supporter — we hit 100%!

Intel Xeon Firmware Vulnerabilities (INTEL-SA-01313): CVE-2025-20063/24395/21090 Advisory