Intel Core Ultra processors (branch prediction unit initialisation): Part of the Training Solo family: incorrect

CVSS 5.6CVE-2025-24495Firmware, BMC & network fabricTraining Solocurated

Impact

Part of the Training Solo family: incorrect initialisation of the branch prediction unit lets an attacker self-train a predictor within the victim's own domain, so the leak works without the cross-domain training that existing mitigations assume. That is the significance - it sidesteps domain-isolation mitigations rather than defeating them head-on, and it reopens guest-to-host and user-to-kernel leakage on parts believed fixed.

Who can reach it

Local unprivileged code on an affected processor.

What to do

Mitigated by an Intel microcode update plus OS/hypervisor changes. Microcode for this class is normally shipped by your distribution as an early-loadable image, so you can deploy it with a package update and a reboot without waiting for an OEM BIOS release - that distinction is the difference between a week and a quarter. Verify after reboot by reading /sys/devices/system/cpu/vulnerabilities/ rather than assuming the package took effect. Training Solo also needs kernel-side changes for the eBPF and indirect-branch paths; take both.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-24495 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01322.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.