Skip to content
Fencer Vulns
medium 5.6

CVE-2024-45332 json

Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect b…

published 2025-05-13 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-14599

cvss
5.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits
0
none known

Summary

Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect branch predictors for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Patch / fix

  • intel-microcode Debian 12 3.20250512.1~deb12u1
  • intel-microcode Debian 14, Debian 13 3.20250512.1

debian advisories DEBIAN-CVE-2024-45332

  • intel-microcode Ubuntu 20.04 LTS 3.20250512.0ubuntu0.20.04.1
  • intel-microcode Ubuntu 22.04 LTS 3.20250512.0ubuntu0.22.04.1
  • intel-microcode Ubuntu 24.04 LTS 3.20250512.0ubuntu0.24.04.1
  • intel-microcode Ubuntu Pro 16.04 LTS 3.20250512.0ubuntu0.16.04.1+esm1
  • intel-microcode Ubuntu Pro 18.04 LTS 3.20250512.0ubuntu0.18.04.1+esm1

ubuntu advisories UBUNTU-CVE-2024-45332

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • microcode_ctl RHEL 8 4:20250512-1.el8_10
  • microcode_ctl RHEL 9 4:20250211-1.20250512.1.el9_6
  • microcode_ctl RHEL 8.8 TUS, RHEL 8.8 E4S 4:20220809-2.20250512.1.el8_8
  • microcode_ctl RHEL 8.2 AUS 4:20191115-4.20250512.1.el8_2
  • microcode_ctl RHEL 7.7 AUS 2:2.1-53.26.el7_7.1
  • microcode_ctl RHEL 8.6 TUS, RHEL 8.6 E4S, RHEL 8.6 AUS 4:20220207-1.20250512.1.el8_6
  • microcode_ctl RHEL 8.4 AUS 4:20210216-1.20250512.1.el8_4
  • microcode_ctl RHEL 7 ELS 2:2.1-73.24.el7_9

red hat advisories RHSA-2025:10991RHBA-2025:9433RHSA-2025:10162RHSA-2025:10126RHSA-2025:10111RHSA-2025:10109

  • ucode-intel Linux Micro 6.0 20250512-1.1
  • ucode-intel Linux Micro 6.1 20250512-slfo.1.1_1.1
  • ucode-intel SLE Module for Basesystem 15 SP7, SLE Module for Basesystem 15 SP6, SLE Micro 5.5 +19 more 20250512-150200.56.1
  • ucode-intel SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 20250512-152.1
  • microcode_ctl SLES 11 SP4 LTSS EXTREME CORE 1.17-102.83.84.1

suse advisories SUSE-SU-2025:20410-1SUSE-SU-2025:20424-1SUSE-SU-2025:01651-2SUSE-SU-2025:01651-1SUSE-SU-2025:01650-1SUSE-SU-2025:1567-1

  • spectre-meltdown-checker openSUSE Tumbleweed 26.36.0602723-1.1
  • ucode-intel openSUSE Tumbleweed 20250512-1.1

opensuse advisories openSUSE-SU-2026:11242-1openSUSE-SU-2025:15093-1

  • microcode_ctl AlmaLinux 8 4:20250512-1.el8_10

almalinux advisories ALSA-2025:10991

  • microcode_ctl Rocky Linux 8 4:20250512-1.el8_10

rocky linux advisories RLSA-2025:10991

  • intel-ucode Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 20250512-r0

alpine advisories ALPINE-CVE-2024-45332

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-45332 updated cvss 5.6

microcode_ctl: Exposure of sensitive information

  • Red Hat Enterprise Linux 6 microcode_ctl
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux BaseOS (v. 8) microcode_ctl 20250512-1.el8_10
    fixed: vendor fix RHSA-2025:10991
  • Red Hat Enterprise Linux BaseOS (v. 9) microcode_ctl 20250211-1.20250512.1.el9_6
    fixed: vendor fix RHBA-2025:9433
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) microcode_ctl 20191115-4.20250512.1.el8_2
    fixed: vendor fix RHSA-2025:10126
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) microcode_ctl 20210216-1.20250512.1.el8_4
    fixed: vendor fix RHSA-2025:10107
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) microcode_ctl 20220207-1.20250512.1.el8_6 Red Hat Enterprise Linux BaseOS E4S (v.8.6) microcode_ctl 20220207-1.20250512.1.el8_6
    fixed: vendor fix RHSA-2025:10109
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) microcode_ctl 20220809-2.20250512.1.el8_8
    fixed: vendor fix RHSA-2025:10162
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) microcode_ctl 20220207-1.20250512.1.el9_0
    fixed: vendor fix RHSA-2025:10103
show 7 more
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) microcode_ctl 20220809-2.20250512.1.el9_2
    fixed: vendor fix RHSA-2025:10102
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) microcode_ctl 20230808-2.20250512.1.el9_4
    fixed: vendor fix RHSA-2025:10101
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) microcode_ctl 20220207-1.20250512.1.el8_6
    fixed: vendor fix RHSA-2025:10109
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) microcode_ctl 20220809-2.20250512.1.el8_8
    fixed: vendor fix RHSA-2025:10162
  • Red Hat Enterprise Linux Server (v. 7 ELS) microcode_ctl 2.1-73.24.el7_9
    fixed: vendor fix RHSA-2025:10108
  • Red Hat Enterprise Linux Server AUS (v. 7.7) microcode_ctl 2.1-53.26.el7_7.1
    fixed: vendor fix RHSA-2025:10111
  • Red Hat Enterprise Linux 10 microcode_ctl
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 5.7 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA 3.1 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
CNA 4.0 5.7 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • n/a Intel(R) Processors

Classification

Weakness
  • CWE-1423 Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.