CVE-2025-22047

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-22047", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.810Z", "datePublished": "2025-04-16T14:12:07.061Z", "dateUpdated": "2026-08-05T11:56:19.652Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:56:19.652Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/microcode/AMD: Fix __apply_microcode_amd()'s return value\n\nWhen verify_sha256_digest() fails, __apply_microcode_amd() should propagate\nthe failure by returning false (and not -1 which is promoted to true)."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The microcode loader is reached only locally \u2014 via the initrd/builtin blob at boot, CPU hotplug/resume, or a write to `/sys/devices/system/cpu/microcode/reload`; there is no network-reachable path, and the resulting unmitigated-CPU exposure is exploited by local code.\nAC:L - The wrong return value is deterministic \u2014 every microcode blob whose SHA256 digest is not in the kernel's hardcoded `phashes[]` table takes the buggy path with 100% reliability, with no race, timing window, or memory-layout dependency.\nPR:L - The vulnerable state (forged `boot_cpu_data.microcode`, cleared Zenbleed chicken bit, false \"updated\" report) is produced by ordinary unattended microcode loading, so an attacker needs no more than an unprivileged local account to then exploit the CPU errata that the kernel wrongly believes are fixed.\nUI:N - No victim action is required \u2014 early loading from initrd runs on every boot and `load_ucode_amd_ap()`/`mc_bp_resume()` run on every CPU bring-up and resume, all automatically.\nS:U - The defeated integrity check, the corrupted `boot_cpu_data.microcode` state and the mis-set `MSR_AMD64_DE_CFG` chicken bit all live within the host kernel/CPU security authority; no VMM or IOMMU boundary is crossed by the flaw itself.\nC:H - Clearing `MSR_AMD64_DE_CFG_ZEN2_FP_BACKUP_FIX_BIT` on the basis of a forged revision re-enables Zenbleed (CVE-2023-20593), giving unprivileged local code a cross-process/cross-VM read of register contents including keys and passwords, and the un-applied blob also carries speculative-execution mitigations.\nI:H - An attacker/blob-controlled 32-bit `hdr.patch_id` is written unverified into kernel security state (`boot_cpu_data.microcode`, `c->microcode`, cpuinfo), and that value directly drives modification of a hardware protection mechanism via `msr_clear_bit()` \u2014 a full bypass of the integrity check the code exists to enforce.\nA:H - The kernel reports a successful update while the CPU keeps running old microcode, so errata that AMD patches fix \u2014 including hang- and machine-check-inducing ones and the erratum 1386 XSAVES malfunction gated on the forged revision \u2014 remain live with no signal to the operator."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kernel/cpu/microcode/amd.c"], "versions": [{"version": "bef830144febedb7de86863ae99d8f53bed76e95", "lessThan": "763f4d638f71cb45235395790a46e9f9e84227fd", "status": "affected", "versionType": "git"}, {"version": "3e8653e399e7111a3e87d534ff4533b250ae574f", "lessThan": "ada88219d5315fc13f2910fe278c7112d8d68889", "status": "affected", "versionType": "git"}, {"version": "c162ba4f45ab6ef3b7114af6fb419f1833f050c0", "lessThan": "d295c58fad1d5ab987a81f139dd21498732c4f13", "status": "affected", "versionType": "git"}, {"version": "50cef76d5cb0e199cda19f026842560f6eedc4f7", "lessThan": "7f705a45f130a85fbf31c2abdc999c65644c8307", "status": "affected", "versionType": "git"}, {"version": "50cef76d5cb0e199cda19f026842560f6eedc4f7", "lessThan": "31ab12df723543047c3fc19cb8f8c4498ec6267f", "status": "affected", "versionType": "git"}, {"version": "6.6.81", "lessThan": "6.6.87", "status": "affected", "versionType": "semver"}, {"version": "6.12.18", "lessThan": "6.12.23", "status": "affected", "versionType": "semver"}, {"version": "6.13.6", "lessThan": "6.13.11", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/kernel/cpu/microcode/amd.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.87", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.23", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.11", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.2", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.81", "versionEndExcluding": "6.6.87"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.18", "versionEndExcluding": "6.12.23"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13.6", "versionEndExcluding": "6.13.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.14.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/763f4d638f71cb45235395790a46e9f9e84227fd"}, {"url": "https://git.kernel.org/stable/c/ada88219d5315fc13f2910fe278c7112d8d68889"}, {"url": "https://git.kernel.org/stable/c/d295c58fad1d5ab987a81f139dd21498732c4f13"}, {"url": "https://git.kernel.org/stable/c/7f705a45f130a85fbf31c2abdc999c65644c8307"}, {"url": "https://git.kernel.org/stable/c/31ab12df723543047c3fc19cb8f8c4498ec6267f"}], "title": "x86/microcode/AMD: Fix __apply_microcode_amd()'s return value", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/kernel/cpu/microcode/amd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "763f4d638f71cb45235395790a46e9f9e84227fd", "status": "affected", "version": "bef830144febedb7de86863ae99d8f53bed76e95", "versionType": "git"}, {"lessThan": "ada88219d5315fc13f2910fe278c7112d8d68889", "status": "affected", "version": "3e8653e399e7111a3e87d534ff4533b250ae574f", "versionType": "git"}, {"lessThan": "d295c58fad1d5ab987a81f139dd21498732c4f13", "status": "affected", "version": "c162ba4f45ab6ef3b7114af6fb419f1833f050c0", "versionType": "git"}, {"lessThan": "7f705a45f130a85fbf31c2abdc999c65644c8307", "status": "affected", "version": "50cef76d5cb0e199cda19f026842560f6eedc4f7", "versionType": "git"}, {"lessThan": "31ab12df723543047c3fc19cb8f8c4498ec6267f", "status": "affected", "version": "50cef76d5cb0e199cda19f026842560f6eedc4f7", "versionType": "git"}, {"lessThan": "6.6.87", "status": "affected", "version": "6.6.81", "versionType": "semver"}, {"lessThan": "6.12.23", "status": "affected", "version": "6.12.18", "versionType": "semver"}, {"lessThan": "6.13.11", "status": "affected", "version": "6.13.6", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/kernel/cpu/microcode/amd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.87", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.23", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.11", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB4ED8CF-6CC9-4385-BD66-06D3ECD64642", "versionEndExcluding": "6.6.87", "versionStartIncluding": "6.6.81", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2408E758-CD5B-4D69-AB5A-B470FE7A0B6D", "versionEndExcluding": "6.12.23", "versionStartIncluding": "6.12.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2ED56B74-EE4E-4FD9-878C-0E7509D3258F", "versionEndExcluding": "6.13.11", "versionStartIncluding": "6.13.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*", "matchCriteriaId": "7DE421BA-0600-4401-A175-73CAB6A6FB4E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*", "matchCriteriaId": "1759FFB7-531C-41B1-9AE1-FD3D80E0D920", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*", "matchCriteriaId": "AD948719-8628-4421-A340-1066314BBD4A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14.1:*:*:*:*:*:*:*", "matchCriteriaId": "368D376F-50DC-452F-8D91-2586C7B344FB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/microcode/AMD: Fix __apply_microcode_amd()'s return value\n\nWhen verify_sha256_digest() fails, __apply_microcode_amd() should propagate\nthe failure by returning false (and not -1 which is promoted to true)."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/microcode/AMD: Se corrige el valor de retorno de __apply_microcode_amd() Cuando verify_sha256_digest() falla, __apply_microcode_amd() debe propagar la falla devolviendo falso (y no -1 que se promueve a verdadero)."}], "id": "CVE-2025-22047", "lastModified": "2026-07-30T06:22:08.723", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-04-16T15:15:58.123", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/31ab12df723543047c3fc19cb8f8c4498ec6267f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/763f4d638f71cb45235395790a46e9f9e84227fd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7f705a45f130a85fbf31c2abdc999c65644c8307"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ada88219d5315fc13f2910fe278c7112d8d68889"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d295c58fad1d5ab987a81f139dd21498732c4f13"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: x86/microcode/AMD: Fix __apply_microcode_amd()'s return value", "id": "2360214", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2360214"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nx86/microcode/AMD: Fix __apply_microcode_amd()'s return value\nWhen verify_sha256_digest() fails, __apply_microcode_amd() should propagate\nthe failure by returning false (and not -1 which is promoted to true)."], "name": "CVE-2025-22047", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-04-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-22047\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-22047\nhttps://lore.kernel.org/linux-cve-announce/2025041602-CVE-2025-22047-9cc8@gregkh/T"], "threat_severity": "Low"}

{}