Introduction
Privilege escalation in the core firmware of Intel Xeon processors can break the isolation that critical workloads in data centers and cloud environments rely on. CVE-2025-24305 is a flaw in the Alias Checking Trusted Module (ACTM) firmware, and it directly affects trusted computing features such as Intel SGX and TDX.
About Intel and Xeon: Intel is the dominant provider of server and data center processors worldwide. Its Xeon line runs a significant share of enterprise, cloud, and high-performance computing infrastructure. Intel's security technologies, including SGX and TDX, underpin confidential computing and trusted execution environments across the industry.
Technical Information
CVE-2025-24305 comes from insufficient control flow management (CWE-691) in the ACTM firmware of some Intel Xeon processors. ACTM is the firmware module that handles memory alias detection and isolation, and it helps protect the integrity of Intel's trusted computing base (TCB) for SGX and TDX.
A privileged local user can manipulate the control flow of the ACTM firmware. That can let them bypass the security boundaries the trusted module enforces and escalate privilege. The underlying cause is logic or validation errors in how the firmware implements control flow. Exploitation requires local administrative access. No public exploit code or detailed attack vectors have been disclosed.
Affected Systems and Versions
- Intel Xeon processors with ACTM firmware are affected
- Intel's advisory INTEL-SA-01313 lists the specific affected models and firmware versions
- Exploitation requires local privileged access
- The issue is particularly relevant to systems that use Intel SGX or TDX features
Vendor Security History
Intel has a history of firmware vulnerabilities affecting control flow and trusted execution environments. Prior advisories include INTEL-SA-01111 and INTEL-SA-01073, which addressed similar privilege escalation issues in Xeon firmware. Intel follows a standard coordinated disclosure and patching process, but supply chain complexity can delay updates for end users.
