Intel Processors CVE-2025-35979

Exploitation requires all of the following: (1) the attacker must have unprivileged code execution inside a guest virtual machine running on affected Intel hardware with VMX (VT-x) virtualization active - bare-metal or non-virtualized deployments are not in scope; (2) attack complexity is high (AC:H) and specific attack requirements must be present (AT:P), meaning the attacker must engineer precise timing conditions and microarchitectural state - this is not a fire-and-forget exploit; (3) the attacking process must run with at least low-privilege credentials on the guest OS (PR:L), ruling out purely anonymous or pre-auth network attack paths. Limiting factors: exploitation is constrained to local VMX guest execution, requires no user interaction but demands high attack sophistication, has no known public exploit, and SSVC rates it non-automatable. This is not exploitable against default bare-metal or containerized (non-VM) deployments.

Multiple signals converge on a low-to-moderate real-world priority despite the high confidentiality impact. EPSS at 0.01% (3rd percentile) indicates near-zero observed exploitation activity. SSVC rates exploitation as none and automatable as no, and this CVE does not appear in CISA KEV. CVSS 4.0 scores 6.8 with AC:H and AT:P, reflecting that successful exploitation requires precise timing, specific microarchitectural state, and a virtualized environment. The SC:H (subsequent-system confidentiality: high) metric is the most concerning signal - it implies potential cross-VM boundary data leakage, which is serious in cloud and shared-hosting contexts. Red Hat and SUSE tagging suggests the Linux virtualization ecosystem is directly in scope. The risk is real but operationally constrained: this is not a trivially exploitable flaw, has no public POC, and requires local guest code execution as a prerequisite. Prioritize patching in multi-tenant hypervisor environments and public cloud workloads over single-tenant or bare-metal deployments.

An attacker with unprivileged code execution inside a guest virtual machine constructs a precisely timed workload that poisons the shared branch predictor tables while the CPU is in VMX non-root mode. By timing cache access patterns after triggering speculative execution influenced by the poisoned predictor state, the attacker infers the contents of memory belonging to a co-resident VM or the hypervisor - potentially leaking cryptographic keys, credentials, or other sensitive in-memory data. No public proof-of-concept has been identified, and the high attack complexity means exploitation requires significant microarchitectural expertise.