EUVD-2025-209577Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with high complexity (transient execution requires specific conditions, per AT:P); scope change applies as data leaks across privilege boundaries; no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floating point divisor unit, potentially resulting in loss of confidentiality.
AnalysisAI
Transient execution side-channel exposure in AMD EPYC 7001 Series and EPYC Embedded 3000 Series processors permits a local low-privileged attacker to leak limited sensitive data through the floating point divisor unit's microarchitectural state during speculative execution. Exploitation is constrained to local access with specific attack conditions present (CVSS 4.0 AT:P), placing this firmly in the Spectre/Meltdown class of hardware-level vulnerabilities. No public exploit code or active exploitation has been identified; EPSS sits at 0.01% (1st percentile) and CISA SSVC rates exploitation as none with non-automatable attack path.
Technical ContextAI
CWE-1420 (Exposure of Sensitive Information during Transient Execution) describes a class of microarchitectural side-channel vulnerabilities where CPUs speculatively execute instructions and leave observable traces in hardware structures such as caches, TLBs, or execution unit state before those instructions are architecturally committed or retired. In this case, the vulnerable component is the floating point divisor unit within AMD EPYC processors. By carefully crafting FP division operations and observing timing or cache residue side channels, an attacker can infer data values transiently processed by the unit that should be architecturally invisible. Affected CPEs are cpe:2.3:a:amd:amd_epyc™_7001_series_processors:*:*:*:*:*:*:*:* and cpe:2.3:a:amd:amd_epyc™_embedded_3000_series_processors:*:*:*:*:*:*:*:*. Xen has also issued advisory XSA-488, indicating the vulnerability is relevant to hypervisor and virtualized workload isolation contexts.
RemediationAI
AMD has confirmed a patch is available as an OS update for both affected product lines. Apply the OS-level update provided by the operating system vendor, which delivers microcode or kernel mitigations. Ubuntu users should apply the update described in USN-8488-1 (https://ubuntu.com/security/notices/USN-8488-1). Xen hypervisor administrators should apply the patches described in Xen Security Advisory XSA-488 (http://xenbits.xen.org/xsa/advisory-488.html). Consult AMD security bulletin AMD-SB-7053 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7053.html) for the authoritative vendor guidance. No exact patched OS or microcode version numbers are specified in the available reference data. As a compensating control in high-sensitivity multi-tenant environments where patching is delayed, restricting co-residency of mutually distrusting workloads on the same physical host limits the practical exploitability window; this trades scheduling flexibility for isolation assurance.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today