CVE-2025-54505 & CVE-2025-54518: Linux Kernel HWE Flaws — AMD Speculative Execution & Privilege Escalation

A new security advisory (USN-8569-1) has been released addressing critical vulnerabilities in the Linux Hardware Enablement (HWE) kernel. These flaws specifically impact AMD processors, exposing systems to speculative execution attacks and local privilege escalation.

For defenders, this is a high-priority event. The vulnerabilities—CVE-2025-54505 and CVE-2025-54518—allow local attackers to bypass hardware isolation boundaries. While 'local' access is required, the implications are severe in multi-tenant environments, hosted containers, or scenarios where a single low-privilege user compromise is leveraged to gain root control or exfiltrate sensitive data from memory.

Technical Analysis

Affected Products

• Platform: Ubuntu Linux (versions utilizing the HWE kernel stack)
• Hardware: Specific AMD processors (FP Divider unit) and AMD Zen 2 processors.
• Component: Linux Kernel (HWE).

CVE-2025-54505: Speculative Execution Data Leak

• Mechanism: It was discovered that certain AMD processors do not properly clear data in the floating point divider unit during speculative execution operations. This creates a side-channel vulnerability reminiscent of previous Spectre/Meltdown class issues.
• Impact: A local attacker can utilize this flaw to expose sensitive information from memory, potentially including encryption keys or data from other processes.
• Exploitation Status: Theoretical to low-barrier Proof of Concept (PoC). Side-channel timing attacks are well-understood in the security community.

CVE-2025-54518: Zen 2 Privilege Escalation

• Mechanism: Some AMD Zen 2 processors fail to properly isolate shared resources in the operation cache. A local attacker can manipulate this isolation failure to corrupt instructions executing at a higher privilege level.
• Impact: This results in unauthorized privilege gain, allowing a standard user to escalate to root.
• Exploitation Status: High severity. Local Privilege Escalation (LPE) is a common post-exploitation step for adversaries.

Detection & Response

Detecting exploitation of speculative execution bugs is difficult, as they leave little in traditional logs. However, we can detect the mechanism (high-resolution timing via performance counters) and the outcome (privilege escalation). Additionally, identifying unpatched kernel versions is critical for threat hunting.

Sigma Rules

These rules target the usage of performance monitoring tools often used in side-channel exploitation and generic privilege escalation anomalies.

---
title: Potential Side-Channel Exploitation via Perf Events
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious usage of perf performance counters often associated with side-channel timing attacks (e.g., CVE-2025-54505 research).
references:
  - https://ubuntu.com/security/notices/USN-8569-1
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1499.001
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/perf'
      - '/perf-record'
      - '/perf-stat'
    CommandLine|contains:
      - 'record'
      - 'stat'
  condition: selection
falsepositives:
  - Legitimate system profiling by developers or administrators
level: low
---
title: Linux Privilege Escalation via Unexpected Parent
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects root shell spawns from non-standard parent processes, potentially indicating successful LPE (e.g., CVE-2025-54518).
references:
  - https://ubuntu.com/security/notices/USN-8569-1
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'EXECVE'
    uid: '0'
    a0|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
  filter_legit_shells:
    ppid|endswith:
      - 'sshd'
      - 'systemd'
      - 'login'
  condition: selection and not filter_legit_shells
falsepositives:
  - Administrators troubleshooting via sudo from a custom script
level: high

KQL (Microsoft Sentinel)

This hunt query identifies Linux hosts running vulnerable HWE kernel versions by ingesting Syslog data. It also correlates with unexpected sudo usage.

// Hunt for vulnerable Linux Kernel versions and sudo anomalies
let VulnerableKernels = dynamic(["5.15.0", "6.5.0", "6.8.0"]); // Add specific vulnerable sub-versions from advisory
Syslog
| where ProcessName == "kernel"
| extend KernelVersion = extract(@'Linux version ([\d\.\-]+)', 1, SyslogMessage)
| where KernelVersion has_any (VulnerableKernels)
| distinct HostName, KernelVersion
| join (
    Syslog
    | where ProcessName == "sudo"
    | project HostName, TimeGenerated, SyslogMessage
) on HostName
| project TimeGenerated, HostName, KernelVersion, SudoActivity=SyslogMessage

Velociraptor VQL

This artifact hunts for the kernel version to confirm patch status and checks for active processes related to performance monitoring that might indicate exploit testing.

-- Hunt for vulnerable kernel versions and suspicious perf usage
SELECT 
  Uname.Version AS KernelVersion,
  Uname.Release AS KernelRelease,
  Uname.Machine AS Architecture
FROM uname()
WHERE KernelVersion =~ "5.15" OR KernelVersion =~ "6.5" OR KernelVersion =~ "6.8"

-- Check for running perf processes (common in side-channel exploit dev)
SELECT Pid, Name, Exe, Username, Cmdline
FROM pslist()
WHERE Name =~ "perf"

Remediation Script (Bash)

This script validates the current kernel version and applies the necessary updates for USN-8569-1.

#!/bin/bash

# Remediation Script for USN-8569-1 (CVE-2025-54505 & CVE-2025-54518)
# Checks for updates and applies critical kernel patches

echo "[+] Checking current kernel version..."
uname -r

echo "[+] Updating package lists..."
apt-get update -y

echo "[+] Checking for security updates..."
# Check specifically for linux-image-generic-hwe updates
apt-get upgrade -s | grep -i linux-image

echo "[+] Applying critical kernel updates..."
# Non-interactive upgrade for automation safety
DEBIAN_FRONTEND=noninteractive apt-get upgrade -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold"

echo "[+] Update complete. A reboot is REQUIRED to load the new kernel."
echo "[+] Please schedule a downtime to reboot the host."

Remediation

To mitigate these vulnerabilities, immediate patching is required.

1. Apply Patches: Update the linux-image-generic-hwe packages to the versions specified in USN-8569-1. This usually involves running sudo apt update && sudo apt upgrade on affected Ubuntu systems.
2. Reboot: Kernel updates require a system reboot to load the patched kernel and activate the mitigations (CPU microcode updates).
3. Verify: Post-reboot, verify the kernel version using uname -r to ensure the system is no longer running the vulnerable HWE kernel versions.
4. References:
   • Ubuntu USN-8569-1 Advisory

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub