GCP-2025-044

<p><strong>Published: </strong>2025-08-12</p><h3 class="hide-from-toc" data-text="Description" id="description_9" tabindex="-1">Description</h3><table> <thead> <tr> <th width="70%">Description</th> <th>Severity</th> <th>Notes</th> </tr> </thead> <tbody> <tr> <td> <p>Intel has notified Google of two new security vulnerabilities.</p> <p>CVE-2025-21090: This vulnerability affects the following Intel processors:</p> <ul> <li>Sapphire Rapids: C3, Z3, H3, A3, v5p VM Families</li> <li>Emerald Rapids: N4, C4, M4, A3 Ultra, A4 VM Families</li> <li>Granite Rapids: N4, C4 VM Family</li> </ul> <p>CVE-2025-22840: This vulnerability affects the following Intel processor:</p> <ul> <li>Granite Rapids: N4, C4 VM Family</li> </ul> <h4 data-text="What should I do?" id="what-should-i-do_8" tabindex="-1">What should I do?</h4> <p>No customer action is required for either vulnerability. Google will proactively update your systems during your standard and planned maintenance windows. At this time, no evidence of exploitation has been found or reported to Google.</p> <h4 data-text="What vulnerabilities are being addressed?" id="what-vulnerabilities-are-being-addressed_5" tabindex="-1">What vulnerabilities are being addressed?</h4> <p>The vulnerability, <a href="https://www.cve.org/CVERecord?id=CVE-2025-21090">CVE-2025-21090</a>, allows an unprivileged actor utilizing the AMX CPU instruction, in conjunction with the AVX CPU instruction, to render the host machine inoperative.</p> <p>The vulnerability, <a href="https://www.cve.org/CVERecord?id=CVE-2025-22840">CVE-2025-22840</a>, allows an unprivileged actor utilizing the prefetchit CPU instruction to load memory content it would otherwise not have access to, potentially leading to remote code execution.</p> </td> <td>Medium</td> <td> <ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2025-21090">CVE-2025-21090</a></li> <li><a href="https://www.cve.org/CVERecord?id=CVE-2025-22840">CVE-2025-22840</a></li> </ul> </td> </tr> </tbody> </table>