Security Bulletin: Vulnerabilities in Intel Chipset affect IBM Cloud Pak System (CVE-2021-0060, CVE-2021-0147, CVE-2021-33080)

Summary

Vulnerabilities in Intel Chipset affect IBM Cloud Pak System. IBM Cloud Pak System has addressed these vulnerabilities.

Vulnerability Details

CVEID:CVE-2021-0060
**DESCRIPTION:**Intel SPS could allow a physical attacker to gain elevated privileges on the system, caused by insufficient compartmentalization in HECI subsystem. By sending a specially-crafted request, an attacker could exploit this vulnerability to gain elevated privileges.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219020 for the current score.
CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H)

CVEID:CVE-2021-0147
**DESCRIPTION:**Intel Chipset firmware is vulnerable to a denial of service, caused by improper locking in the Power Management Controller (PMC). By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 4.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219022 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2021-33068
**DESCRIPTION:**Intel AMT is vulnerable to a denial of service, caused by a NULL pointer dereference in the subsystem. By sending a specially-crafted request, a remote authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219021 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

For unsupported release/version/platform IBM recommends to upgrade to supported fixed release of the product.

Recommended Firmware updates are listed in the table below. Firmware have been updated with IBM Cloud Pak System v2.3.3.5.

For IBM Cloud Pak System v2.3.0.1, v2.3.1.1, v2.3.2.0, v2.3.3.0, v.2.3.3.1, v.2.3.3.2, v.2.3.3.3, v2.3.3.3 Interim Fix 1, v2.3.3.4

upgrade to IBM Cloud Pak System v2.3.3.5 at Fix Central

Information on upgrading : <http://www.ibm.com/support/docview.wss?uid=ibm10887959&gt;

Workarounds and Mitigations

None