CVE-2025-54505 & CVE-2025-54518: AMD Processor Vulnerabilities in Linux Kernel (GCP FIPS) — Defense and Remediation

On February 24, 2026, Ubuntu released USN-8574-1, addressing critical security vulnerabilities in the Linux kernel, specifically for the Google Cloud Platform (GCP) FIPS Certified images. These vulnerabilities impact specific AMD processor generations—Zen 2 and Zen 5—and expose serious risks in multi-tenant or high-security environments.

For defenders, the urgency here is twofold. First, CVE-2025-54518 represents a privilege escalation vector via operation cache isolation failures, potentially allowing a local attacker to corrupt instructions executed at a higher privilege level. Second, CVE-2025-54505 highlights a return to speculative execution concerns, where improper data clearing in the floating point divider unit could expose sensitive information. Additionally, a third flaw was identified affecting RDSEED entropy on AMD Zen 5 processors, which could undermine cryptographic operations.

Given that these issues affect the GCP FIPS kernel—often deployed in regulated, high-compliance environments—security teams must treat this as a high-priority patching event. This post provides the technical breakdown, detection logic, and the necessary remediation steps to secure your Linux endpoints.

Technical Analysis

The advisory USN-8574-1 details three distinct hardware-software interaction flaws affecting AMD processors within the Linux kernel ecosystem:

CVE-2025-54505: AMD Speculative Execution Data Leak

• Affected Component: AMD Floating Point Divider Unit.
• Mechanism: Similar to historical speculative execution vulnerabilities (Spectre/Meltdown variants), specific AMD processors fail to properly clear data in the floating point divider unit during speculative execution.
• Attack Vector: A local attacker can leverage this side-channel to read sensitive data from the CPU state that should have been discarded. In a cloud environment, this poses a risk of cross-VM information disclosure if the hypervisor mitigations are bypassed or if the attacker has already compromised a lower-privilege user context on the host.

CVE-2025-54518: AMD Zen 2 Operation Cache Isolation Failure

• Affected Component: AMD Zen 2 Operation Cache.
• Mechanism: The processor did not properly isolate shared resources within the operation cache.
• Attack Vector: This is a classic privilege escalation scenario. A local attacker can manipulate the shared cache to corrupt instructions executed at a higher privilege level (e.g., Kernel Mode). Successful exploitation allows the attacker to gain unauthorized privileges, effectively bypassing the kernel's user-space boundary.

AMD Zen 5 RDSEED Entropy Issue (Undisclosed CVE)

• Affected Component: AMD Zen 5 RDSEED Instruction.
• Mechanism: The processor did not properly handle entropy generation.
• Attack Vector: A local attacker could influence the values returned by the RDSEED instruction. This leads to the consumption of insufficiently random values, potentially weakening cryptographic keys or session tokens generated by the system's RNG (Random Number Generator).

Affected Platforms

• OS: Ubuntu Linux (GCP FIPS images).
• Architecture: AMD64 (specifically AMD Zen 2 and Zen 5 processors).
• Exploitation Status: Theoretical local exploitation. No active in-the-wild exploitation has been confirmed at the time of this advisory, but the feasibility of privilege escalation (CVE-2025-54518) makes it a prime target for sophisticated actors post-publication.

Detection & Response

Detecting these specific CPU vulnerabilities at runtime is challenging because the attacks are local hardware-level exploits. However, we can detect the preparatory behaviors attackers often engage in before exploiting hardware flaws: probing CPU capabilities and accessing Model Specific Registers (MSRs) to check for vulnerability.

The detection rules below focus on identifying tools and behaviors commonly associated with hardware vulnerability testing and speculative execution attacks, such as accessing /dev/cpu/*/msr or running side-channel testing scripts.

SIGMA Rules

---
title: Potential CPU Speculative Execution Vulnerability Probing
id: 8a1c9d2e-4f5a-4b2c-8a3d-9e4f5a6b7c8d
status: experimental
description: Detects attempts to access Model Specific Registers (MSR) or execution of known side-channel testing scripts, which are precursors to exploiting CVE-2025-54505 or CVE-2025-54518.
references:
  - https://ubuntu.com/security/notices/USN-8574-1
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_msr_access:
    CommandLine|contains:
      - '/dev/cpu'
      - 'rdmsr'
      - 'wrmsr'
  selection_testing_tools:
    CommandLine|contains:
      - 'spectre-meltdown-checker'
      - 'microcode-ctl'
      - 'amd_ucode_info'
  condition: 1 of selection_*
falsepositives:
  - Legitimate system administration or hardware diagnostics
level: medium
---
title: AMD Zen Processor Specific Enumeration via lscpu
id: 9b2d0e3f-5g6b-5c3d-9b4e-0f5g6a7b8c9e
status: experimental
description: Detects the use of lscpu to detailed enumerate CPU architecture, specifically looking for AMD family/model queries often used to target Zen 2/Zen 5 vulnerabilities.
references:
  - https://ubuntu.com/security/notices/USN-8574-1
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1082
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/lscpu'
    CommandLine|contains:
      - '-C'
      - '-e'
  filter_vendor:
    CommandLine|contains:
      - 'VendorID=AuthenticAMD'
  condition: selection and filter_vendor
falsepositives:
  - System inventory scripts
level: low

KQL (Microsoft Sentinel / Defender)

Hunts for Linux endpoints accessing MSRs or running CPU enumeration tools, often indicative of hardware vulnerability research.

// Hunt for MSR access or CPU enumeration on Linux endpoints
DeviceProcessEvents
| where Timestamp > ago(7d)
| where OSType == "Linux"
| where ProcessCommandLine has_any ("/dev/cpu", "rdmsr", "wrmsr", "msr-tools")
   or (ProcessCommandLine has "lscpu" and ProcessCommandLine has "AMD")
   or (ProcessCommandLine has "spectre-meltdown-checker")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

Velociraptor VQL

This artifact hunts for the presence of AMD Zen 2 or Zen 5 processors and checks the kernel version to assess exposure risk.

-- Hunt for AMD Zen 2/Zen 5 Processors and Kernel Version
SELECT
  OSInfo.Version AS KernelVersion,
  Hardware.CpuModel AS CpuModel,
  Hardware.CpuVendor AS Vendor,
  Hardware.CpuFamily AS Family,
  Hardware.CpuModelNumber AS ModelNum
FROM info()
WHERE Vendor =~ "AMD"
  AND (
      CpuModel =~ "Zen 2" OR 
      CpuModel =~ "Zen 5" OR 
      (Family == 23 AND ModelNum >= 49 AND ModelNum <= 113) OR 
      (Family == 26)
  )

Remediation Script (Bash)

Use this script to audit your Ubuntu GCP FIPS instances for the presence of affected AMD processors and verify the kernel patch status.

#!/bin/bash

# Security Arsenal: Audit Script for USN-8574-1 (AMD Kernel Vulnerabilities)
# Checks for AMD Zen 2/Zen 5 processors and current kernel version

echo "[+] Starting Audit for USN-8574-1..."

# Check CPU Vendor
VENDOR=$(lscpu | grep "Vendor ID:" | awk '{print $3}')
if [ "$VENDOR" != "AuthenticAMD" ]; then
    echo "[INFO] Non-AMD processor detected. USN-8574-1 does not apply."
    exit 0
fi
echo "[WARN] AMD Processor detected. Checking architecture..."

# Check for Zen 2 or Zen 5 architectures
# Note: Family 23 is Zen 2, Family 26 is Zen 5
FAMILY=$(lscpu | grep "CPU family:" | awk '{print $3}')
MODEL=$(lscpu | grep "Model:" | awk '{print $2}')

AFFECTED=false
if [ "$FAMILY" == "23" ]; then
    echo "[ALERT] AMD Zen 2 (Family 23) processor detected. Vulnerable to CVE-2025-54518."
    AFFECTED=true
elif [ "$FAMILY" == "26" ]; then
    echo "[ALERT] AMD Zen 5 (Family 26) processor detected. Vulnerable to RDSEED entropy issue."
    AFFECTED=true
fi

# Get Kernel Version
KERNEL_VERSION=$(uname -r)
echo "[INFO] Current Kernel Version: $KERNEL_VERSION"

# Check if USN-8574-1 fix is applied (Generic check, update with specific version per advisory)
# As a defensive measure, we recommend updating to the latest kernel provided by Ubuntu
if [ "$AFFECTED" = true ]; then
    echo "[ACTION REQUIRED] System is potentially vulnerable based on CPU architecture."
    echo "[REMEDIATION] Run 'sudo apt update && sudo apt install linux-image-generic' to patch."
    echo "[REMEDIATION] Reboot required to load the new kernel."
else
    echo "[INFO] AMD processor detected, but not in the explicitly vulnerable families (Zen 2 / Zen 5) listed in USN-8574-1."
fi

echo "[+] Audit Complete."

Remediation

To effectively mitigate these vulnerabilities, organizations must apply the vendor patches provided in USN-8574-1.

1. Patch Management: Update the Linux kernel on all affected Ubuntu GCP FIPS instances immediately.

   • Run the standard update command: sudo apt update && sudo apt upgrade and specifically target the linux-image-generic package.
   • Ensure the system is rebooted to load the secure kernel.

2. Verify Firmware Updates: While the kernel patches provide software mitigations, ensure your underlying AMD CPU microcode is up to date, as some hardware-level fixes (especially for RDSEED) may require coordinated microcode updates from your Cloud Provider or Hardware Vendor.

3. Vendor Advisory: Review the official Ubuntu Security Notice for the specific kernel version numbers that contain the fix.

   • Source: USN-8574-1

4. CISA KEV: Monitor CISA's Known Exploited Vulnerabilities catalog. While not listed at the time of writing, the privilege escalation capability of CVE-2025-54518 makes it a candidate for future inclusion.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub