medium 5.6

CVE-2024-43420 json

Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel At…

published 2025-05-13 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-14606

cvss: 5.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits: 0; none known

Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel Atom(R) processors may allow an authenticated user to potentially enable information disclosure via local access.

Patch / fix

distros 8

debian ubuntu red hat suse opensuse almalinux rocky linux alpine

intel-microcode Debian 12 3.20250512.1~deb12u1
intel-microcode Debian 14, Debian 13 3.20250512.1

debian advisories DEBIAN-CVE-2024-43420

intel-microcode Ubuntu 20.04 LTS 3.20250512.0ubuntu0.20.04.1
intel-microcode Ubuntu 22.04 LTS 3.20250512.0ubuntu0.22.04.1
intel-microcode Ubuntu 24.04 LTS 3.20250512.0ubuntu0.24.04.1
intel-microcode Ubuntu Pro 16.04 LTS 3.20250512.0ubuntu0.16.04.1+esm1
intel-microcode Ubuntu Pro 18.04 LTS 3.20250512.0ubuntu0.18.04.1+esm1

ubuntu advisories UBUNTU-CVE-2024-43420

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

microcode_ctl RHEL 8 4:20250512-1.el8_10
microcode_ctl RHEL 9 4:20250211-1.20250512.1.el9_6
microcode_ctl RHEL 8.8 TUS, RHEL 8.8 E4S 4:20220809-2.20250512.1.el8_8
microcode_ctl RHEL 8.2 AUS 4:20191115-4.20250512.1.el8_2
microcode_ctl RHEL 7.7 AUS 2:2.1-53.26.el7_7.1
microcode_ctl RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 4:20220207-1.20250512.1.el8_6
microcode_ctl RHEL 8.4 AUS 4:20210216-1.20250512.1.el8_4
microcode_ctl RHEL 7 ELS 2:2.1-73.24.el7_9

red hat advisories RHSA-2025:10991 RHBA-2025:9433 RHSA-2025:10162 RHSA-2025:10126 RHSA-2025:10111 RHSA-2025:10109

ucode-intel Linux Micro 6.0 20250512-1.1
ucode-intel Linux Micro 6.1 20250512-slfo.1.1_1.1
ucode-intel SLE Module for Basesystem 15 SP7, SLE Module for Basesystem 15 SP6, SLE Micro 5.5 +19 more 20250512-150200.56.1
ucode-intel SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 20250512-152.1
microcode_ctl SLES 11 SP4 LTSS EXTREME CORE 1.17-102.83.84.1

suse advisories SUSE-SU-2025:20410-1 SUSE-SU-2025:20424-1 SUSE-SU-2025:01651-2 SUSE-SU-2025:01651-1 SUSE-SU-2025:01650-1 SUSE-SU-2025:1567-1

ucode-intel openSUSE Tumbleweed 20250512-1.1

opensuse advisories openSUSE-SU-2025:15093-1

microcode_ctl AlmaLinux 8 4:20250512-1.el8_10

almalinux advisories ALSA-2025:10991

microcode_ctl Rocky Linux 8 4:20250512-1.el8_10

rocky linux advisories RLSA-2025:10991

intel-ucode Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 20250512-r0

alpine advisories ALPINE-CVE-2024-43420

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-43420 updated 2026-11-07 cvss 5.6

microcode_ctl: Exposure of sensitive information

Red Hat Enterprise Linux 6 microcode_ctl
affected: no fix available “Fix deferred”
Red Hat Enterprise Linux BaseOS (v. 8) microcode_ctl 20250512-1.el8_10
fixed: vendor fix RHSA-2025:10991
Red Hat Enterprise Linux BaseOS (v. 9) microcode_ctl 20250211-1.20250512.1.el9_6
fixed: vendor fix RHBA-2025:9433
Red Hat Enterprise Linux BaseOS AUS (v. 8.2) microcode_ctl 20191115-4.20250512.1.el8_2
fixed: vendor fix RHSA-2025:10126
Red Hat Enterprise Linux BaseOS AUS (v.8.4) microcode_ctl 20210216-1.20250512.1.el8_4
fixed: vendor fix RHSA-2025:10107
Red Hat Enterprise Linux BaseOS AUS (v.8.6) microcode_ctl 20220207-1.20250512.1.el8_6 Red Hat Enterprise Linux BaseOS E4S (v.8.6) microcode_ctl 20220207-1.20250512.1.el8_6
fixed: vendor fix RHSA-2025:10109
Red Hat Enterprise Linux BaseOS E4S (v.8.8) microcode_ctl 20220809-2.20250512.1.el8_8
fixed: vendor fix RHSA-2025:10162
Red Hat Enterprise Linux BaseOS E4S (v.9.0) microcode_ctl 20220207-1.20250512.1.el9_0
fixed: vendor fix RHSA-2025:10103

show 7 more

Red Hat Enterprise Linux BaseOS E4S (v.9.2) microcode_ctl 20220809-2.20250512.1.el9_2
fixed: vendor fix RHSA-2025:10102
Red Hat Enterprise Linux BaseOS EUS (v.9.4) microcode_ctl 20230808-2.20250512.1.el9_4
fixed: vendor fix RHSA-2025:10101
Red Hat Enterprise Linux BaseOS TUS (v.8.6) microcode_ctl 20220207-1.20250512.1.el8_6
fixed: vendor fix RHSA-2025:10109
Red Hat Enterprise Linux BaseOS TUS (v.8.8) microcode_ctl 20220809-2.20250512.1.el8_8
fixed: vendor fix RHSA-2025:10162
Red Hat Enterprise Linux Server (v. 7 ELS) microcode_ctl 2.1-73.24.el7_9
fixed: vendor fix RHSA-2025:10108
Red Hat Enterprise Linux Server AUS (v. 7.7) microcode_ctl 2.1-53.26.el7_7.1
fixed: vendor fix RHSA-2025:10111
Red Hat Enterprise Linux 10 microcode_ctl
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 17 mo ago (2025-05-14)

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.7	CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	3.1	5.6	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
CNA	4.0	5.7	CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

n/a Intel Atom(R) processors

Classification

Weakness

CWE-1423 Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution

References

Sources

CVE List CVE-2024-43420
NVD CVE-2024-43420

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary