CVE-2025-27572

Vulnerability

Overview CVE-2025-27572 describes an exposure of sensitive information during transient execution within Intel Trust Domain Extensions (TDX) at Ring 0 (hypervisor level). This is a side-channel vulnerability that arises from speculative or out-of-order execution, similar to other transient execution attacks. The flaw resides in the TDX module, which is responsible for isolating trusted domains from the host hypervisor.

Exploitation

Requirements Exploitation requires an authorized adversary with a privileged user account on the system, combined with a high-complexity attack. The attack is performed locally and does not require user interaction. The adversary must have special internal knowledge of the system to meet the attack prerequisites. The attack vector is local access, meaning the attacker must already have a foothold on the vulnerable platform.

Impact

Successful exploitation could lead to the disclosure of sensitive information from the hypervisor or other trusted domains, with a high confidentiality impact. Integrity and availability are not affected. The vulnerability does not allow the attacker to modify data or cause denial of service; it only enables information leakage.

Mitigation

Intel has released a security advisory (INTEL-SA-01397) [1] that provides firmware updates and guidance to mitigate this vulnerability. Users are advised to apply the latest TDX module updates from their platform vendor. No workarounds are mentioned, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog as of publication.