Two security updates have been issued for Ubuntu, affecting various versions of the operating system. The first update addresses vulnerabilities in Intel Microcode, specifically affecting Intel Xeon processors with SGX enabled and stream cache mechanisms. A local authenticated user could potentially use these issues to escalate their privileges or cause a denial of service, prompting updates for multiple Ubuntu releases, including 25.10, 25.04, 24.04 LTS, and others. The second update addresses vulnerabilities in rust-sudo-rs, a Rust-based implementation of sudo and su, specifically with password handling during timeouts and targetpw/rootpw default settings when creating timestamp files.

[USN-7866-1] Intel Microcode vulnerabilities
[USN-7867-1] sudo-rs vulnerabilities

[USN-7866-1] Intel Microcode vulnerabilities

==========================================================================
Ubuntu Security Notice USN-7866-1
November 10, 2025

intel-microcode vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10
- Ubuntu 25.04
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Intel Microcode.

Software Description:
- intel-microcode: Processor microcode for Intel CPUs

Details:

Barak Gross discovered that some Intel Xeon processors with SGX enabled
did not properly handle buffer restrictions. A local authenticated user
could potentially use this issue to escalate their privileges.
(CVE-2025-20053)

Avinash Maddy discovered that some Intel processors did not properly
isolate or compartmentalize the stream cache mechanisms. A local
authenticated user could potentially use this issue to escalate their
privileges. (CVE-2025-20109)

Joseph Nuzman discovered that some Intel Xeon processors did not properly
manage references to active allocate resources. A local authenticated user
could potentially use this issue to cause a denial of service (system
crash). (CVE-2025-21090)

It was discovered that some Intel Xeon 6 processors did not properly
provide sufficient granularity of access control in the out of band
management service module (OOB-MSM). An authenticated user could
potentially use this issue to escalate their privileges. (CVE-2025-22839)

It was discovered that some Intel Xeon 6 Scalable processors did not
properly handle a specific sequence of processor instructions, leading to
unexpected behavior. A local authenticated user could potentially use this
issue to escalate their privileges. (CVE-2025-22840)

Joseph Nuzman discovered that some Intel Xeon 6 processors with Intel
Trust Domain Extensions (Intel TDX) did not properly handle overlap
between protected memory ranges. A local authenticated user could
potentially use this issue to escalate their privileges. (CVE-2025-22889)

Avraham Shalev discovered that some Intel Xeon processors did not
properly provide sufficient control flow management in the Alias Checking
Trusted Module (ACTM) firmware. A local authenticated user could
potentially use this issue to escalate their privileges. (CVE-2025-24305)

Aviv Eisen and Avraham Shalev discovered that some Intel Xeon 6
processors when using Intel SGX or Intel TDX did not properly protect
against out-of-bounds writes in the memory subsystem. A local authenticated
user could potentially use this issue to escalate their privileges.
(CVE-2025-26403)

Aviv Eisen and Avraham Shalev discovered that some Intel Xeon 6
processors when using Intel SGX or Intel TDX did not properly implement
security checks in the DDRIO configuration. A local authenticated user
could potentially use this issue to escalate their privileges.
(CVE-2025-32086)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
intel-microcode 3.20250812.0ubuntu0.25.10.1

Ubuntu 25.04
intel-microcode 3.20250812.0ubuntu0.25.04.1

Ubuntu 24.04 LTS
intel-microcode 3.20250812.0ubuntu0.24.04.1

Ubuntu 22.04 LTS
intel-microcode 3.20250812.0ubuntu0.22.04.1

Ubuntu 20.04 LTS
intel-microcode 3.20250812.0ubuntu0.20.04.1+esm1
Available with Ubuntu Pro

Ubuntu 18.04 LTS
intel-microcode 3.20250812.0ubuntu0.18.04.1+esm1
Available with Ubuntu Pro

Ubuntu 16.04 LTS
intel-microcode 3.20250812.0ubuntu0.16.04.1+esm1
Available with Ubuntu Pro

After a standard system update you need to reboot your computer to make all
the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7866-1
CVE-2025-20053, CVE-2025-20109, CVE-2025-21090, CVE-2025-22839,
CVE-2025-22840, CVE-2025-22889, CVE-2025-24305, CVE-2025-26403,
CVE-2025-32086

Package Information:
https://launchpad.net/ubuntu/+source/intel-microcode/3.20250812.0ubuntu0.25.10.1
https://launchpad.net/ubuntu/+source/intel-microcode/3.20250812.0ubuntu0.25.04.1
https://launchpad.net/ubuntu/+source/intel-microcode/3.20250812.0ubuntu0.24.04.1
https://launchpad.net/ubuntu/+source/intel-microcode/3.20250812.0ubuntu0.22.04.1

[USN-7867-1] sudo-rs vulnerabilities

==========================================================================
Ubuntu Security Notice USN-7867-1
November 10, 2025

rust-sudo-rs vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10

Summary:

Several security issues were fixed in sudo-rs.

Software Description:
- rust-sudo-rs: Rust-based sudo and su implementations

Details:

It was discovered that sudo-rs incorrectly handled passwords when timeouts
occurred and the pwfeedback default was not set. This could result in a
partially typed password being output to standard input, contrary to
expectations.

It was discovered that sudo-rs incorrectly handled the targetpw and rootpw
default settings when creating timestamp files. A local attacker could
possibly use this issue to bypass authentication in certain configurations.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
sudo-rs 0.2.8-1ubuntu5.2

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7867-1
https://launchpad.net/bugs/2130623

Package Information:
https://launchpad.net/ubuntu/+source/rust-sudo-rs/0.2.8-1ubuntu5.2