CVE-2025-35979: Intel Processor Information Disclosure

CVE-2025-35979 Overview

CVE-2025-35979 is a transient execution side-channel vulnerability affecting some Intel processors. The flaw stems from shared microarchitectural predictor state that influences speculative execution within VMX non-root (guest) operation. An unprivileged authenticated user executing code inside a virtual machine guest may infer sensitive information from outside the guest boundary through carefully crafted speculative execution sequences. The vulnerability requires local access and a high-complexity attack path, but no user interaction. Intel published advisory SA-01420 documenting the issue and affected processor families.

Critical Impact

A local authenticated attacker operating inside a VMX guest may disclose confidential data from the host or other guests via microarchitectural side channels, breaking virtualization isolation boundaries.

Affected Products

• Select Intel processors supporting Intel Virtualization Technology (VT-x) with VMX non-root (guest) operation
• Virtualized environments where untrusted guests share physical CPU cores with sensitive workloads
• Hypervisor platforms running on affected Intel silicon (see Intel SA-01420 for the specific processor list)

Discovery Timeline

• 2026-05-12 - CVE-2025-35979 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2025-35979

Vulnerability Analysis

The vulnerability is a side-channel information disclosure caused by shared microarchitectural predictor state across privilege and virtualization boundaries. Modern Intel processors use branch and indirect predictors to speculatively execute instructions ahead of architectural commit. When predictor state created in one context persists into VMX non-root (guest) execution, an attacker inside the guest can steer transient execution down attacker-controlled paths. Secret-dependent loads or branches during this transient window leave observable traces in shared microarchitectural resources such as the cache hierarchy.

The attack falls in the same family as Spectre-class transient execution issues. Exploitation requires precise timing, knowledge of victim code layout, and the ability to train predictors. The integrity and availability of the system are not affected, but confidentiality impact is high both for the vulnerable component and for subsequent systems sharing the predictor state. The EPSS probability is currently 0.015%, reflecting the operational difficulty of executing the attack at scale.

Root Cause

The root cause is insufficient isolation of microarchitectural predictor state between VMX root (host/hypervisor) and VMX non-root (guest) operation. Predictor entries trained in one security domain influence speculation in another, enabling a transient execution side channel [CWE-1303-class behavior].

Attack Vector

An attacker requires local code execution as an authenticated low-privileged user inside a VMX guest. The attacker primes predictor structures, induces the victim context to execute a gadget speculatively, and then measures residual microarchitectural state (typically via cache timing) to recover secret bits. No user interaction is required. The high attack complexity reflects the need for stable timing, gadget discovery, and predictor training that bypasses partitioning mitigations.

No verified public proof-of-concept code is available for CVE-2025-35979. Refer to the Intel Security Advisory SA-01420 for processor-specific technical details and mitigation guidance.

Detection Methods for CVE-2025-35979

Indicators of Compromise

• No reliable host-based indicators exist for successful exploitation, since side-channel attacks do not leave conventional artifacts in logs or on disk
• Unexpected long-running compute-bound processes inside guest VMs that perform tight cache-timing loops may warrant investigation
• Guest workloads issuing unusually high volumes of clflush, prefetch, or serializing instructions can indicate cache-timing measurement

Detection Strategies

• Inventory bare-metal hosts and confirm CPU microcode versions against the levels listed in Intel SA-01420
• Use hypervisor telemetry to identify guests that are pinned to cores shared with sensitive workloads
• Apply behavioral analytics to flag guest processes exhibiting cache-probing patterns or abnormal performance counter usage

Monitoring Recommendations

• Continuously monitor microcode revision levels across the virtualization fleet and alert on drift from the patched baseline
• Track hypervisor configuration changes affecting indirect branch prediction barriers and core scheduling policies
• Collect host and guest CPU performance counter telemetry into a centralized data lake for longitudinal analysis

How to Mitigate CVE-2025-35979

Immediate Actions Required

• Apply the Intel microcode update referenced in Intel Security Advisory SA-01420 to all affected hosts
• Update hypervisor software (VMware ESXi, Microsoft Hyper-V, KVM, Xen) to versions that enable the new microcode mitigations
• Restrict the ability of untrusted users to run arbitrary code inside guest VMs on shared infrastructure

Patch Information

Intel has published advisory SA-01420 with microcode updates that address the predictor state leakage between VMX root and non-root operation. System administrators should obtain the microcode through their OEM BIOS/UEFI update channel or through operating system vendor microcode packages. Hypervisor vendors typically release coordinated updates that load the new microcode and enable the appropriate prediction barriers at VM entry and exit. Confirm the patched microcode revision is loaded by inspecting /proc/cpuinfo on Linux hosts or the equivalent diagnostic output on Windows and ESXi.

Workarounds

• Disable simultaneous multithreading (SMT/Hyper-Threading) on hosts running mutually distrusting tenants to reduce predictor sharing
• Pin sensitive workloads to dedicated physical cores and avoid co-scheduling with untrusted guest VMs
• Enable hypervisor options that flush or partition branch predictor state on VM entry and exit where supported
• Restrict guest access for unauthenticated and low-trust users until microcode updates are deployed

# Verify loaded microcode revision on a Linux host
grep -m1 microcode /proc/cpuinfo

# Check kernel-reported CPU vulnerability status
grep -r . /sys/devices/system/cpu/vulnerabilities/

# Disable SMT as a defense-in-depth measure (Linux)
echo off > /sys/devices/system/cpu/smt/control