Database/Firmware, BMC & network fabric
Intel Xeon processor firmware (SGX enabled): Improper buffer restrictions in Xeon firmware on SGX-enabled parts, giving
CVSS 7.2CVE-2025-20053Firmware, BMC & network fabriccurated
Impact
Improper buffer restrictions in Xeon firmware on SGX-enabled parts, giving a privileged local user an escalation path. Firmware-level, so it lands underneath anything the OS can defend.
Who can reach it
Privileged local access on the host.
What to do
Platform firmware/BIOS update from the OEM plus SGX TCB recovery. Full drain and reboot per node; OEM release timing dominates the rollout.
References
Related entries
- Intel Xeon 6 memory subsystem (with SGX or TDX): An out-of-bounds write in the Xeon 6 memory subsystem reachable whenCVE-2025-26403 · Intel Xeon 6 memory subsystem (with SGX or TDX)High
- Intel Xeon 6 DDRIO configuration (with SGX or TDX): An improperly implemented security check in DDRIO configuration onCVE-2025-32086 · Intel Xeon 6 DDRIO configuration (with SGX or TDX)High
- AMI AptioV UEFI BIOS: Improper handling of insufficient permissions in the BIOS lets a low-privileged local userCVE-2025-58770 · AMI AptioV UEFI BIOSHigh
- Supermicro BMC firmware validation (MBD-X13SEM-F): Second-generation RoT bypassCVE-2025-6198 · Supermicro BMC firmware validation (MBD-X13SEM-F)High
- AMD Pensando ionic driver on ESXi: untrusted pointer dereference lets a guest VM read kernel and co-tenant memoryCVE-2025-62627 · AMD Pensando ionic cloud driver for VMware ESXi (DPU datapath)High
- Supermicro BMC firmware validation (MBD-X12STW): RoT bypass, crafted firmware image acceptedCVE-2025-7937 · Supermicro BMC firmware validation (MBD-X12STW)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.