Intel processors, exploitable from within VMX non-root (guest) operation - INTEL-SA-01420: Shared microarchitectural

CVSS 6.8CVE-2025-35979Firmware, BMC & network fabricguest-mode predictor state leakVMX non-root transient execution disclosurecurated

Impact

Shared microarchitectural predictor state influences transient execution inside guest (VMX non-root) operation, letting unprivileged software in a VM observe data it should not. This is the shape of bug that matters most to anyone renting VMs on shared hosts: the leak is reachable from inside a guest by ordinary unprivileged code, targeting state shared with whatever else the host is running. For a neocloud running multiple tenant VMs per physical machine, it is a tenant-boundary issue by construction; for a bare-metal-per-tenant product it is contained to that tenant.

Who can reach it

Unprivileged software inside a guest VM. Intel rates the attack complexity as high and notes attack requirements must be present, so this is a capable-adversary scenario rather than a commodity exploit - but the position required is just 'a customer with a VM'.

What to do

Microcode/BIOS update via OEM firmware - firmware flash, host reboot, job drain - plus hypervisor updates where the VMM must invoke the new controls. This is part of Intel's 2026 quarterly advisory batch, so bundle it with the other CVEs in that IPU rather than scheduling separately; the marginal cost of adding it to an existing firmware window is zero and the cost of its own window is a full fleet drain. No SMT decision attached. Verify by microcode revision and by the hypervisor's own mitigation reporting.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-35979 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01420.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.