CVE-2025-54505: AMD Speculative Execution Flaw Patched in Ubuntu GCP Kernel — Detection and Remediation Guide

Canonical has released USN-8668-1, a security update for the Linux kernel on Google Cloud Platform (GCP) images, addressing three distinct vulnerabilities — two of which are current-generation hardware issues that defenders running Ubuntu workloads on AMD-backed cloud infrastructure need to treat as priority items:

• CVE-2025-54505 — Certain AMD processors fail to properly clear data in the floating point divider unit during speculative execution. A local attacker can exploit this to expose sensitive information from the processor.
• An AMD Zen 2 operation cache isolation flaw — Some AMD Zen 2 processors do not properly isolate shared resources in the operation cache, allowing a local attacker to potentially corrupt instructions executed at a higher privilege level.
• CVE-2023-45896 — An NTFS filesystem implementation flaw where file name length is not properly validated in certain situations, leading to an out-of-bounds read. A maliciously crafted NTFS image, when mounted and operated on, could expose kernel memory.

The 2025-era hardware vulnerabilities are the headline here. CVE-2023-45896 is an older bug now shipping in this cumulative kernel update; we cover its operational relevance below, but the strategic concern is the AMD speculative execution and op-cache issues, which follow the pattern of microarchitectural side channels that are trivially exploitable in multi-tenant and containerized environments.

Why This Matters to Defenders

If you run Ubuntu on GCP — particularly on AMD EPYC-backed machine types — you have local information disclosure and potential privilege-level instruction corruption exposure from any code executing on the same host. In practical terms:

1. Multi-tenant risk amplification. In cloud and containerized environments, "local attacker" includes a co-tenant workload, a compromised container, or a low-privileged service account. Speculative execution side channels turn any code execution into a memory disclosure primitive.
2. The op-cache issue is a corruption primitive, not just disclosure. Corrupting instructions at a higher privilege level is a potential path from userland to kernel-level impact — a materially worse outcome than a pure read side channel.
3. The NTFS bug extends attack surface to image handling. Any pipeline that mounts user-supplied or third-party NTFS images (forensics tooling, data ingestion, backup restore, email attachment detonation) is exposed to kernel memory disclosure.

Technical Analysis

CVE-2025-54505 — Floating Point Divider Speculative Side Channel

Affected component: AMD processor floating point divider unit; mitigated via the Linux kernel GCP build.

Attack mechanics (defender's view): During speculative execution, the divider unit does not fully clear intermediate data before another context uses the unit. A local attacker executing unprivileged code can measure residual state left in the divider to infer data belonging to another process or privilege domain. This is a classic transient-execution side channel: exploitation requires local code execution but no elevated privileges, and it leaves almost no traditional forensic footprint — no crash, no log entry, no anomalous syscall beyond the attacker's own benign-looking arithmetic workload.

Exploitation status: As of this writing there is no confirmed in-the-wild exploitation and no CISA KEV listing associated with these CVEs; the issue is a research-discovered microarchitectural flaw. However, CPU side channels of this class historically move from disclosure to public PoC rapidly, and weaponization requires no user interaction. Treat as pre-emptive remediation, not emergency patch, but do not let it age.

AMD Zen 2 Operation Cache Isolation Flaw

Affected component: Operation cache (op-cache) on AMD Zen 2 microarchitecture processors.

Attack mechanics: The op-cache stores decoded instructions and is a shared resource. Insufficient isolation between privilege domains allows a local attacker to influence or corrupt cached instructions subsequently executed at a higher privilege level. This crosses the line from information disclosure into integrity impact against privileged execution — the class of bug that can underpin sandbox escapes and hypervisor boundary violations.

CVE-2023-45896 — NTFS Out-of-Bounds Read

Affected component: Linux kernel NTFS filesystem driver.

Attack mechanics: The NTFS implementation fails to validate file name length in certain code paths. An attacker constructs a malicious NTFS image; when a victim system mounts the image and operates on it (directory listing, file access), the kernel reads out of bounds, disclosing kernel memory contents. Exploitation requires the attacker to get a crafted image mounted — via social engineering, a malicious USB device, a compromised data pipeline, or abuse of auto-mounting (udisks2/GVFS) on desktop and server systems that auto-mount removable media.

Defensive relevance today: This is a cumulative-update fix, but it highlights a real detection opportunity: unexpected NTFS mounts are a high-signal, low-noise event on cloud Linux servers. There is almost no legitimate reason for an NTFS filesystem to be mounted on a GCP production instance.

Affected Systems

• Ubuntu systems running the GCP-optimized Linux kernel (linux-image-gcp / linux-image-*-gcp packages) prior to the USN-8668-1 update.
• Workloads on AMD processor families with the floating point divider issue (CVE-2025-54505).
• Workloads on AMD Zen 2 processors for the op-cache isolation issue.
• Any Ubuntu system that mounts NTFS images prior to the patched kernel.

Verify your exposure by checking the running kernel package and CPU:

# Identify the running kernel flavor — look for '-gcp' in the version string
uname -r

# Check installed GCP kernel packages
dpkg -l | grep linux-image | grep gcp

# Identify CPU vendor, model, and stepping (Zen 2 = Family 23, models 49h, 71h, etc.)
lscpu | grep -E 'Vendor ID|Model name|CPU family|Model:'

# Review current CPU vulnerability mitigation status
for f in /sys/devices/system/cpu/vulnerabilities/*; do echo "$f: $(cat $f)"; done

Detection & Response

Hardware side channels are notoriously difficult to detect directly — the attacker's workload looks like ordinary floating point math. The high-value detections here are behavioral and environmental: unexpected NTFS mounts (CVE-2023-45896 exploitation), attempts to disable or weaken kernel mitigations (a common precursor to side-channel abuse research or to benchmark cheating that weakens your posture), and audit of unpatched kernel exposure.

Sigma Rules

---
title: Unexpected NTFS Filesystem Mount on Linux Server
id: 3f7a2c91-8b4d-4e6a-a1c2-9d5e6f7a8b9c
status: experimental
description: Detects mounting of NTFS filesystems on Linux systems, which may indicate exploitation attempts against the kernel NTFS driver (e.g., CVE-2023-45896 malicious image attacks). NTFS mounts are highly unusual on production cloud Linux servers.
references:
  - https://ubuntu.com/security/notices/USN-8668-1
  - https://attack.mitre.org/techniques/T1200/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.initial_access
  - attack.t1200
logsource:
  category: process_creation
  product: linux
detection:
  selection_mount:
    Image|endswith:
      - '/mount'
      - '/mount.ntfs'
      - '/mount.ntfs-3g'
      - '/ntfs-3g'
      - '/lowntfs-3g'
    CommandLine|contains:
      - 'ntfs'
  selection_udisks:
    Image|endswith:
      - '/udisksctl'
    CommandLine|contains:
      - 'mount'
      - 'ntfs'
  condition: 1 of selection_*
falsepositives:
  - Forensic or data-recovery workstations legitimately mounting NTFS media
  - Backup/restore pipelines handling NTFS images
level: high
---
title: Linux Kernel Mitigation Controls Disabled or Weakened
id: 8c1d4e52-3a6b-4f7c-b2d3-4e5f6a7b8c9d
status: experimental
description: Detects attempts to disable Linux kernel CPU vulnerability mitigations via kernel command line parameters or sysfs writes. Weakening mitigations such as spec_store_bypass_disable may precede side-channel research or abuse of speculative execution flaws such as CVE-2025-54505.
references:
  - https://ubuntu.com/security/notices/USN-8668-1
  - https://attack.mitre.org/techniques/T1562.001/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmdline:
    CommandLine|contains:
      - 'mitigations=off'
      - 'nospectre'
      - 'spec_store_bypass_disable=off'
      - 'nopti'
      - 'tsx_async_abort=off'
  selection_sysfs:
    Image|endswith:
      - '/tee'
      - '/sh'
      - '/bash'
    CommandLine|contains:
      - '/sys/kernel/debug/x86/pti_enabled'
      - '/proc/sys/kernel/unprivileged_bpf_disabled'
      - 'spec_store_bypass'
  condition: 1 of selection_*
falsepositives:
  - Performance benchmarking by platform engineering (should be change-controlled)
  - Vendor-directed tuning for specific HPC workloads
level: medium

KQL — Microsoft Sentinel

If you ingest Linux syslog and auditd data into Sentinel (via the Syslog/CEF or AMA connector), the following hunt surfaces NTFS mount activity and mitigation-weakening attempts across your Ubuntu fleet:

// Hunt: NTFS mounts and CPU mitigation tampering on Linux (USN-8668-1 context)
let timeframe = 7d;
union isfuzzy=true
    (Syslog
    | where TimeGenerated > ago(timeframe)
    | where ProcessName has_any ("mount", "ntfs-3g", "mount.ntfs", "udisksctl", "kernel")
    | where SyslogMessage has_any ("ntfs", "mitigations=off", "nospectre", "spec_store_bypass")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
    ),
    (CommonSecurityLog
    | where TimeGenerated > ago(timeframe)
    | where Message has_any ("ntfs-3g", "mount.ntfs", "mitigations=off", "nospectre")
    | project TimeGenerated, DeviceName=Computer, Message, SourceIP
    )
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), EventCount=count()
    by Computer, ProcessName, SyslogMessage
| order by LastSeen desc

For environments using Microsoft Defender for Endpoint on Linux, pivot on DeviceProcessEvents:

// MDE on Linux: hunt for NTFS mount execution and mitigation tampering
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("mount", "mount.ntfs", "ntfs-3g", "lowntfs-3g", "udisksctl")
   or ProcessCommandLine has_any ("ntfs", "mitigations=off", "nospectre", "spec_store_bypass_disable=off")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName
| order by TimeGenerated desc

Velociraptor VQL

This artifact enumerates currently mounted filesystems and recent mount-related process execution — useful for triaging whether any NTFS media has been attached to a Linux fleet, and for confirming mitigation state on AMD hosts:

-- Hunt: NTFS mounts, suspicious mount processes, and kernel mitigation state
SELECT * FROM foreach(
  row={
    SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
    FROM pslist()
    WHERE CommandLine =~ 'ntfs|mitigations=off|nospectre|spec_store_bypass'
       OR Exe =~ 'ntfs-3g|mount\\.ntfs'
  },
  query={
    SELECT Pid, Name, CommandLine, Username, CreateTime
    FROM scope()
  })

-- Also enumerate active mounts for NTFS entries
SELECT Device, MountPoint, FSType
FROM parse_file_with_regex(
  filename='/proc/mounts',
  buffer='(?P<Device>\\S+) (?P<MountPoint>\\S+) (?P<FSType>\\S+)'
)
WHERE FSType =~ 'ntfs'

-- Capture kernel mitigation status for the fleet record
SELECT read_file(filename='/sys/devices/system/cpu/vulnerabilities/spectre_v2') AS SpectreV2Status,
       read_file(filename='/proc/cmdline') AS KernelCmdline
FROM scope()

Verification and Remediation Script

The following Bash script checks whether a host is running the vulnerable GCP kernel, applies the USN-8668-1 update, and verifies mitigation state post-patch:

#!/usr/bin/env bash
# USN-8668-1 verification and remediation — run with sudo on Ubuntu GCP instances
set -euo pipefail

echo "=== [1] Current kernel ==="
uname -r

echo "=== [2] CPU identification ==="
lscpu | grep -E 'Vendor ID|Model name|CPU family|Model:' || true

echo "=== [3] Pre-patch mitigation status ==="
for f in /sys/devices/system/cpu/vulnerabilities/*; do
  echo "$(basename "$f"): $(cat "$f")"
done

echo "=== [4] Checking for available GCP kernel update ==="
apt-get update -qq
apt-cache policy linux-image-gcp linux-image-virtual | grep -A2 '^linux-image'

echo "=== [5] Applying USN-8668-1 kernel update ==="
DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade linux-image-gcp

echo "=== [6] Ensuring microcode package is present (AMD) ==="
if lscpu | grep -qi 'AuthenticAMD'; then
  DEBIAN_FRONTEND=noninteractive apt-get install -y amd64-microcode || \
    echo "NOTE: amd64-microcode not in repo (restricted/multiverse may be disabled)"
fi

echo "=== [7] Checking for unexpected NTFS mounts ==="
grep -i ntfs /proc/mounts && echo "WARNING: NTFS filesystem mounted — investigate" || echo "OK: no NTFS mounts"

echo "=== [8] Confirming mitigations are not disabled on kernel cmdline ==="
if grep -Eq 'mitigations=off|nospectre|spec_store_bypass_disable=off' /proc/cmdline; then
  echo "WARNING: CPU mitigations weakened in kernel cmdline: $(cat /proc/cmdline)"
else
  echo "OK: kernel cmdline does not disable mitigations"
fi

echo ""
echo "A reboot is REQUIRED for the new kernel to take effect."
echo "After reboot, re-run sections [1] and [3] to confirm the patched kernel and mitigation state."

Remediation Guidance

1. Patch immediately on AMD-backed GCP workloads. Apply the USN-8668-1 kernel update via apt-get install --only-upgrade linux-image-gcp (or your standard image refresh pipeline for golden images). The official advisory is at https://ubuntu.com/security/notices/USN-8668-1. A reboot is mandatory — kernel updates do not mitigate speculative execution flaws until the patched kernel and any accompanying microcode are loaded.
2. Update AMD microcode. Ensure amd64-microcode is installed and that your APT sources include the restricted component. Microarchitectural mitigations frequently require microcode in addition to kernel patches.
3. Verify mitigation state post-patch. After reboot, confirm /sys/devices/system/cpu/vulnerabilities/* entries do not report "Vulnerable," and confirm /proc/cmdline does not contain mitigations=off or equivalent flags. Any host with weakened mitigations should be treated as an exception requiring explicit risk acceptance.
4. Restrict NTFS mounting (CVE-2023-45896 hardening). On servers with no legitimate NTFS requirement: blacklist the ntfs3 module (echo 'blacklist ntfs3' >> /etc/modprobe.d/blacklist-ntfs.conf), disable udisks2 auto-mounting where present, and audit mount execution via auditd (-a always,exit -F arch=b64 -S mount).
5. Prioritize multi-tenant and container hosts. Hosts running untrusted or third-party code — CI runners, shared build systems, container nodes, jump boxes — are the realistic exploitation surface for local side channels. Patch these first.
6. Rebuild golden images. If you deploy Ubuntu GCP images from templates, refresh the base image now so new instances are born patched; do not rely solely on boot-time unattended-upgrades for fleet consistency.
7. Track for KEV and PoC activity. Neither CVE is currently listed in CISA KEV and no active exploitation has been confirmed, but side-channel research of this class historically produces public PoCs. Subscribe to the Ubuntu security notices feed and CISA KEV for changes in exploitation status.

Bottom Line

USN-8668-1 is a reminder that "local" CPU vulnerabilities are not low-priority in cloud environments — they are cross-tenant primitives. The remediation is straightforward (patch, microcode, reboot, verify mitigations), but the verification step is where most organizations fail: an applied kernel package with mitigations=off left on the cmdline is a silently unmitigated fleet. Pair the patch rollout with the NTFS-mount detection above, and you cover both the hardware and filesystem attack surface this notice addresses.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub