Skip to content
OpenAdvisories
High ALAS2-2025-3014 5 CVEs

Important: microcode_ctl security update (Amazon Linux 2)

Published Sep 23, 2025 · Updated Sep 29, 2025

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-32086: Improperly implemented security check for standard in the DDRIO configuration for some Intel(R) Xeon(R) 6 Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2025-26403: Out-of-bounds write in the memory subsystem for some Intel(R) Xeon(R) 6 processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2025-22889: Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processor with Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2025-22840: Sequence of processor instructions leads to unexpected behavior for some Intel(R) Xeon(R) 6 Scalable processors may allow an authenticated user to potentially enable escalation of privilege via local access CVE-2025-22839: Insufficient granularity of access control in the OOB-MSM for some Intel(R) Xeon(R) 6 Scalable processors may allow a privileged user to potentially enable escalation of privilege via adjacent access.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 microcode_ctl 2:2.1-47.amzn2.4.26
Amazon Linux · 2 microcode_ctl-debuginfo 2:2.1-47.amzn2.4.26

Vulnerabilities 5

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22839.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22840.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-22889.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-26403.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-32086.html