DEBIAN-CVE-2025-48517

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2025-48517

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-48517.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2025-48517

Upstream

CVE-2025-48517

Published

2026-02-10T20:16:45.407Z

Modified

2026-02-11T10:18:03.883707Z

Severity

4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

[none]

Details

Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potentially resulting in a partial loss of confidentiality.

References

https://security-tracker.debian.org/tracker/CVE-2025-48517

Affected packages

Debian:11 / amd64-microcode

Package

Name: amd64-microcode
Purl: pkg:deb/debian/amd64-microcode?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.20120117-1

1.*

1.20120117-1

1.20120117-2~bpo60+1

1.20120117-2

1.20120910-1~bpo60+1

1.20120910-1

1.20120910-2~bpo60+1

1.20120910-2

1.20120910-3

1.20141028.1

1.20160316.1

2.*

2.20120910-1~bpo70+1

2.20120910-1

2.20131007.1

2.20131007.1+really20130710.1

2.20141028.1~bpo70+1

2.20141028.1

2.20160316.1~bpo70+1

2.20160316.1~deb8u1

2.20160316.1

3.*

3.20160316.1

3.20160316.2

3.20160316.3

3.20171205.1

3.20171205.2

3.20180515.1

3.20180524.1~bpo9+1

3.20180524.1

3.20181128.1~bpo9+1

3.20181128.1~deb8u1

3.20181128.1~deb9u1

3.20181128.1~deb9u2

3.20181128.1

3.20191021.1

3.20191218.1

3.20220411.1

3.20220411.2

3.20230414.1

3.20230719.1~deb10u1

3.20230719.1~deb11u1

3.20230719.1~deb12u1

3.20230719.1

3.20230808.1

3.20230808.1.1~deb11u1

3.20230808.1.1~deb12u1

3.20230808.1.1

3.20230823.1

3.20231019.1

3.20240116.2

3.20240116.2+nmu1

3.20240710.1

3.20240710.2~deb11u1

3.20240710.2~deb12u1

3.20240710.2

3.20240820.1~deb11u1

3.20240820.1~deb12u1

3.20240820.1

3.20250311.1~deb11u1

3.20250311.1~deb12u1

3.20250311.1

3.20251202.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-48517.json"

Debian:12 / amd64-microcode

Package

Name: amd64-microcode
Purl: pkg:deb/debian/amd64-microcode?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.20120117-1

1.*

1.20120117-1

1.20120117-2~bpo60+1

1.20120117-2

1.20120910-1~bpo60+1

1.20120910-1

1.20120910-2~bpo60+1

1.20120910-2

1.20120910-3

1.20141028.1

1.20160316.1

2.*

2.20120910-1~bpo70+1

2.20120910-1

2.20131007.1

2.20131007.1+really20130710.1

2.20141028.1~bpo70+1

2.20141028.1

2.20160316.1~bpo70+1

2.20160316.1~deb8u1

2.20160316.1

3.*

3.20160316.1

3.20160316.2

3.20160316.3

3.20171205.1

3.20171205.2

3.20180515.1

3.20180524.1~bpo9+1

3.20180524.1

3.20181128.1~bpo9+1

3.20181128.1~deb8u1

3.20181128.1~deb9u1

3.20181128.1~deb9u2

3.20181128.1

3.20191021.1

3.20191218.1

3.20220411.1

3.20220411.2

3.20230414.1

3.20230719.1~deb10u1

3.20230719.1~deb11u1

3.20230719.1~deb12u1

3.20230719.1

3.20230808.1

3.20230808.1.1~deb11u1

3.20230808.1.1~deb12u1

3.20230808.1.1

3.20230823.1

3.20231019.1

3.20240116.2

3.20240116.2+nmu1

3.20240710.1

3.20240710.2~deb11u1

3.20240710.2~deb12u1

3.20240710.2

3.20240820.1~deb11u1

3.20240820.1~deb12u1

3.20240820.1

3.20250311.1~deb11u1

3.20250311.1~deb12u1

3.20250311.1

3.20251202.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-48517.json"

Debian:13 / amd64-microcode

Package

Name: amd64-microcode
Purl: pkg:deb/debian/amd64-microcode?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.20120117-1

1.*

1.20120117-1

1.20120117-2~bpo60+1

1.20120117-2

1.20120910-1~bpo60+1

1.20120910-1

1.20120910-2~bpo60+1

1.20120910-2

1.20120910-3

1.20141028.1

1.20160316.1

2.*

2.20120910-1~bpo70+1

2.20120910-1

2.20131007.1

2.20131007.1+really20130710.1

2.20141028.1~bpo70+1

2.20141028.1

2.20160316.1~bpo70+1

2.20160316.1~deb8u1

2.20160316.1

3.*

3.20160316.1

3.20160316.2

3.20160316.3

3.20171205.1

3.20171205.2

3.20180515.1

3.20180524.1~bpo9+1

3.20180524.1

3.20181128.1~bpo9+1

3.20181128.1~deb8u1

3.20181128.1~deb9u1

3.20181128.1~deb9u2

3.20181128.1

3.20191021.1

3.20191218.1

3.20220411.1

3.20220411.2

3.20230414.1

3.20230719.1~deb10u1

3.20230719.1~deb11u1

3.20230719.1~deb12u1

3.20230719.1

3.20230808.1

3.20230808.1.1~deb11u1

3.20230808.1.1~deb12u1

3.20230808.1.1

3.20230823.1

3.20231019.1

3.20240116.2

3.20240116.2+nmu1

3.20240710.1

3.20240710.2~deb11u1

3.20240710.2~deb12u1

3.20240710.2

3.20240820.1~deb11u1

3.20240820.1~deb12u1

3.20240820.1

3.20250311.1~deb11u1

3.20250311.1~deb12u1

3.20250311.1

3.20251202.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-48517.json"

Debian:14 / amd64-microcode

Package

Name: amd64-microcode
Purl: pkg:deb/debian/amd64-microcode?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.20120117-1

1.*

1.20120117-1

1.20120117-2~bpo60+1

1.20120117-2

1.20120910-1~bpo60+1

1.20120910-1

1.20120910-2~bpo60+1

1.20120910-2

1.20120910-3

1.20141028.1

1.20160316.1

2.*

2.20120910-1~bpo70+1

2.20120910-1

2.20131007.1

2.20131007.1+really20130710.1

2.20141028.1~bpo70+1

2.20141028.1

2.20160316.1~bpo70+1

2.20160316.1~deb8u1

2.20160316.1

3.*

3.20160316.1

3.20160316.2

3.20160316.3

3.20171205.1

3.20171205.2

3.20180515.1

3.20180524.1~bpo9+1

3.20180524.1

3.20181128.1~bpo9+1

3.20181128.1~deb8u1

3.20181128.1~deb9u1

3.20181128.1~deb9u2

3.20181128.1

3.20191021.1

3.20191218.1

3.20220411.1

3.20220411.2

3.20230414.1

3.20230719.1~deb10u1

3.20230719.1~deb11u1

3.20230719.1~deb12u1

3.20230719.1

3.20230808.1

3.20230808.1.1~deb11u1

3.20230808.1.1~deb12u1

3.20230808.1.1

3.20230823.1

3.20231019.1

3.20240116.2

3.20240116.2+nmu1

3.20240710.1

3.20240710.2~deb11u1

3.20240710.2~deb12u1

3.20240710.2

3.20240820.1~deb11u1

3.20240820.1~deb12u1

3.20240820.1

3.20250311.1~deb11u1

3.20250311.1~deb12u1

3.20250311.1

3.20251202.1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-48517.json"