CVE-2025-54505 & CVE-2025-54518: Linux Kernel on AWS — AMD Speculative Execution & Privilege Escalation

A critical security advisory has been released addressing a trio of hardware-level vulnerabilities affecting the Linux kernel on AWS instances, specifically targeting AMD processor architectures. Identified under Ubuntu Security Notice (USN-8595-2), these flaws leverage speculative execution and resource isolation failures to undermine fundamental security boundaries.

For defenders, the implications are severe. While these vulnerabilities require local access to initiate—often a prerequisite for post-exploitation activities—they directly enable the exposure of sensitive data (CVE-2025-54505) and unauthorized privilege escalation (CVE-2025-54518). In cloud environments where multi-tenancy and containerization are common, local access is a frequently achieved milestone. Failure to patch these kernels leaves systems vulnerable to lateral movement and data exfiltration by sophisticated adversaries.

Technical Analysis

USN-8595-2 details three distinct issues within the Linux kernel as it runs on AWS, specifically targeting AMD silicon:

• CVE-2025-54505 (Float Point Divider Leak): This vulnerability affects certain AMD processors. It is caused by improper data clearing in the floating point divider unit during speculative execution. An attacker with local access can exploit this side-channel vulnerability to read sensitive data from memory that should otherwise be isolated. This is a classic transient execution attack, similar in nature to Spectre/Meltdown variants, targeting the floating point arithmetic logic.

• CVE-2025-54518 (Zen 2 Operation Cache Corruption): Affecting AMD Zen 2 processors, this flaw involves a failure to properly isolate shared resources in the operation cache. This allows a local attacker to potentially corrupt instructions that are executed at a higher privilege level. Successful exploitation leads to unauthorized privilege gain, effectively allowing a standard user to escalate to root, compromising the entire host.

• AMD Zen 5 RDSEED Entropy Issue: The advisory notes a third vulnerability affecting AMD Zen 5 processors supporting the RDSEED instruction. These processors fail to properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could influence the values returned by RDSEED, weakening the cryptographic strength of the system.

Affected Platforms

• OS: Linux Kernel (Ubuntu on AWS)
• Architecture: AMD (Specifically Zen 2, Zen 5, and others impacting the Floating Point unit)
• Vector: Local access

Exploitation Status

At the time of this advisory, these are considered high-severity vulnerabilities requiring local execution. While no widespread, automated worm-like exploitation is active, these techniques are standard in sophisticated red team operations and post-breach privilege escalation toolkits.

Detection & Response

Detecting speculative execution attacks like CVE-2025-54505 at the network or host level is notoriously difficult due to the lack of traditional "malicious" API calls or process artifacts. However, we can detect the outcome of CVE-2025-54518 (Privilege Escalation) and verify the patch status of the fleet.

The following detection rules focus on identifying suspicious privilege escalation events and monitoring for the installation of security patches.

Sigma Rules

---
title: Potential Linux Privilege Escalation via Root Shell
id: 8a4c9d22-1e5f-4c9b-9b1d-0f5e9d8a7c6b
status: experimental
description: Detects a shell (bash/sh) running as root spawned by a non-root parent process, potentially indicating successful exploitation of CVE-2025-54518 or similar priv-esc vectors.
references:
  - https://ubuntu.com/security/notices/USN-8595-2
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/bin/bash'
      - '/bin/sh'
      - '/bin/zsh'
    User: root
  filter_legitimate_parents:
    ParentImage|endswith:
      - '/usr/sbin/sshd'
      - '/usr/bin/sudo'
      - '/lib/systemd/systemd'
      - '/sbin/init'
  condition: selection and not filter_legitimate_parents
falsepositives:
  - Administrators using su to switch users
  - Cron jobs running as root
level: high
---
title: Linux Kernel Security Patch Installation
id: 9b5d0e33-2f6a-5d0c-0c2e-1g6f0e9b8d7c
status: experimental
description: Detects the installation of Linux kernel packages via apt/dpkg, useful for verifying patch deployment for USN-8595-2.
references:
  - https://ubuntu.com/security/notices/USN-8595-2
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/usr/bin/dpkg'
      - '/usr/bin/apt-get'
      - '/usr/bin/unattended-upgrade'
    CommandLine|contains:
      - 'linux-image'
      - 'linux-aws'
  condition: selection
falsepositives:
  - System updates during maintenance windows
level: low

KQL (Microsoft Sentinel / Defender)

This query hunts for the installation of the vulnerable kernel updates or unexpected root shells, assuming Linux logs are forwarded via Syslog or the Microsoft Defender for Endpoint (MDE) connector.

// Hunt for Linux Kernel Patch Activity related to USN-8595-2
Syslog
| where ProcessName in ("dpkg", "apt", "apt-get", "unattended-upgrade")
| where SyslogMessage has_any ("linux-image", "linux-aws", "linux-modules")
| extend PkgName = extract_all(@"install\s+(linux-\S+)", SyslogMessage)
| project TimeGenerated, Computer, ProcessName, SyslogMessage, PkgName
| summarize count() by Computer, ProcessName, bin(TimeGenerated, 5m)

// Hunt for Potential Privilege Escalation (MDE for Linux)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("/bin/bash", "/bin/sh", "/bin/dash")
| where AccountName != "root"
| where InitiatingProcessAccountName != "root"
| project Timestamp, DeviceName, FileName, AccountName, InitiatingProcessFileName, CommandLine

Velociraptor VQL

This VQL artifact is designed to audit the running kernel version and hunt for processes that might be the result of a privilege escalation (root shells spawned by non-root users).

-- Check for vulnerable kernel versions and suspicious root shells
SELECT
  Fqdn AS Hostname,
  KernelVersion,
  Pid,
  Name AS ProcessName,
  Username,
  CommandLine,
  Ctime AS ProcessCreationTime
FROM foreach(
  SELECT
    Fqdn,
    OSInfo.KernelVersion AS KernelVersion
  FROM info()
)
(
  SELECT
    Pid,
    Name,
    Username,
    CommandLine,
    Ctime
  FROM pslist()
  WHERE Name IN ("bash", "sh", "zsh")
    AND Username = "root"
    AND ParentUsername != "root"
)

Remediation Script (Bash)

The following script verifies the current kernel version, applies the necessary security updates from the Ubuntu repositories (addressing USN-8595-2), and checks if a reboot is required.

#!/bin/bash

# Remediation Script for USN-8595-2 (AMD Kernel Vulnerabilities)
# Author: Security Arsenal
# Date: 2026-04-10

echo "[+] Starting remediation for USN-8595-2..."

# 1. Update package lists
echo "[*] Updating package lists..."
apt-get update -q

# 2. Check current kernel version
echo "[*] Current kernel version:"
uname -r

# 3. Install security updates for linux-image and linux-aws
echo "[*] Installing linux kernel security updates..."
# --only-upgrade ensures we don't install new kernels if not strictly needed for the fix,
# but generally dist-upgrade is preferred for full security patching.
DEBIAN_FRONTEND=noninteractive apt-get install -y --only-upgrade linux-image-generic linux-aws

# 4. Check if a reboot is required
if [ -f /var/run/reboot-required ]; then
    echo "[!] WARNING: System reboot required to complete the patch."
    cat /var/run/reboot-required.pkgs
else
    echo "[+] No immediate reboot required (or system already up to date)."
fi

echo "[+] Remediation script complete."

Remediation

To fully mitigate the risks associated with CVE-2025-54505, CVE-2025-54518, and the RDSEED issue, the following steps are mandatory:

1. Patch Application: Update the Linux kernel to the versions provided in the USN-8595-2 advisory. For Ubuntu systems, this typically involves running sudo apt-get update followed by sudo apt-get upgrade. Ensure the linux-image-aws or linux-image-generic packages are updated.

2. System Reboot: Kernel updates require a system reboot to load the new, patched kernel and microcode. Simply updating the packages without rebooting leaves the system vulnerable.

3. Verify Microcode: While kernel updates often include microcode fixes, ensure your AMI or instance type is running the latest supported hardware firmware provided by AWS, especially for Zen 2 and Zen 5 processors.

4. Official Advisory: Refer to the Ubuntu Security Notice USN-8595-2 for specific package version numbers and affected distributions.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub