CVE-2025-20012

Incorrect behavior order for some Intel(R) Core™ Ultra Processors may allow an unauthenticated user to potentially enable information disclosure via physical access.

Moderate impact in Red Hat Enterprise Linux: an unauthenticated user with physical access may exploit incorrect behavior ordering in some Intel Core Ultra processors to potentially disclose information through the microcode_ctl component. RHEL 8 and RHEL 6/7 Extended Life Cycle streams are marked DEFER; the current record gives no more specific reason for that deferral, and the residual risk is potential information disclosure on systems with affected processors when physical access is available. RHEL 9 streams are marked DELEGATED as affected, and a fix is being pursued. RHEL 10 is not affected because the vulnerable code is not present. Red Hat's CVSS 3.1 assessment is 5.6 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N), versus the upstream CVSS 3.1 score of 4.9 (AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N); the difference reflects Red Hat's assessment of local access, low privileges, and changed scope, while exploitation remains high-complexity and requires physical access according to the current vulnerability description.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.