CVE-2025-0033 — Improper Access Control in Kernel

CWE-284 — Improper Access ControlCWE-364 — Signal Handler Race Condition12 documents9 sources
Severity
6.0MEDIUMNVD
EPSS
0.0%
top 95.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Linux KernelDebian Amd64-microcodeMsrc Azure Confidential Compute GPU SKU Ncc40ads H100 V5+4 more
Timeline
PublishedOct 14
Latest updateDec 24

Description

Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulting in a loss of SEV-SNP guest memory integrity.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:NExploitability: 1.5 | Impact: 4.0

Affected Packages7 packages

▶Linuxlinux/linux_kernel6.17.0 — 6.17.13+1

🔴Vulnerability Details

3
OSV
md: avoid repeated calls to del_gendisk↗2025-12-24
▶
GHSA
GHSA-9mfq-5f97-7wjc: Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulti↗2025-10-14
▶
OSV
CVE-2025-0033: Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulti↗2025-10-14
▶

📋Vendor Advisories

3
Red Hat
kernel: md: avoid repeated calls to del_gendisk↗2025-12-24
▶
Microsoft
AMD CVE-2025-0033: RMP Corruption During SNP Initialization↗2025-10-14
▶
Debian
CVE-2025-0033: amd64-microcode - Improper access control within AMD SEV-SNP could allow an admin privileged attac...↗2025
▶

🕵️Threat Intelligence

4
Qualys
Microsoft and Adobe Patch Tuesday, October 2025 Security Update Review | Qualys↗2025-10-14
▶
Qualys
Microsoft and Adobe Patch Tuesday, October 2025 Security Update Review↗2025-10-14
▶
Bleepingcomputer
Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws↗2025-10-14
▶
Wiz
CVE-2025-68373 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶