Skip to content
OpenAdvisories
High ALAS2-2025-2993 3 CVEs

Important: microcode_ctl security update (Amazon Linux 2)

Published Sep 8, 2025 · Updated Sep 16, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-24305: Insufficient control flow management in the Alias Checking Trusted Module (ACTM) firmware for some Intel(R) Xeon(R) processors may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2025-21090: Missing reference to active allocated resource for some Intel(R) Xeon(R) processors may allow an authenticated user to potentially enable denial of service via local access. CVE-2025-20053: Improper buffer restrictions for some Intel(R) Xeon(R) Processor firmware with SGX enabled may allow a privileged user to potentially enable escalation of privilege via local access.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 microcode_ctl 2:2.1-47.amzn2.4.25
Amazon Linux · 2 microcode_ctl-debuginfo 2:2.1-47.amzn2.4.25

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-20053.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-21090.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-24305.html