Security Bulletin: IBM QRadar SIEM Appliances could be vulnerable to multiple Intel CVEs

Summary

IBM QRadar SIEM Appliances could be vulnerable to multiple Intel CVEs. IBM has addressed the relevant CVEs.

Vulnerability Details

CVEID:CVE-2021-0091
**DESCRIPTION:**Intel Processors could allow a local attacker to gain elevated privileges on the system, caused by improper access control in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 3.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219044 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N)

CVEID:CVE-2021-0092
**DESCRIPTION:**Intel Processors are vulnerable to a denial of service, caused by improper access control in the firmware. By executing a specially-crafted program, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219043 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H)

CVEID:CVE-2021-0093
**DESCRIPTION:**Intel Processors are vulnerable to a denial of service, caused by incorrect default permissions in the firmware. By executing a specially-crafted program, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219042 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2021-0099
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by insufficient control flow management in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219079 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:CVE-2021-0103
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by insufficient control flow management in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 8.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219078 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

CVEID:CVE-2021-0107
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by unchecked return value in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219041 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N)

CVEID:CVE-2021-0111
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by a NULL pointer dereference in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219040 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N)

CVEID:CVE-2021-0114
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by an unchecked return value in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219077 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

CVEID:CVE-2021-0115
**DESCRIPTION:**Intel Processors are vulnerable to a buffer overflow, caused by improper bounds checking by the firmware. By executing a specially-crafted program, a local authenticated attacker could overflow a buffer and escalate privileges.
CVSS Base score: 7.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219076 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

CVEID:CVE-2021-0116
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by an out-of-bounds write in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219075 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

CVEID:CVE-2021-0117
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by pointer issues in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219074 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

CVEID:CVE-2021-0118
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by an out-of-bounds read in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219073 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

CVEID:CVE-2021-0119
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper initialization in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 5.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219039 for the current score.
CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L)

CVEID:CVE-2021-0124
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper access control in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 6.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219038 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H)

CVEID:CVE-2021-0125
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper initialization in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 6.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219027 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L)

CVEID:CVE-2021-0156
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper input validation in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219072 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)

CVEID:CVE-2021-0127
**DESCRIPTION:**Intel processors are vulnerable to a denial of service, caused by insufficient control flow management. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219024 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H)

CVEID:CVE-2021-0145
**DESCRIPTION:**Intel processors could allow a local authenticated attacker to obtain sensitive information, caused by improper initialization of shared resources. An attacker could exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219023 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:CVE-2021-33120
**DESCRIPTION:**Intel Atom Processors could allow a local authenticated attacker to obtain sensitive information, caused by an out-of-bounds read. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 3.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219098 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L)

Affected Products and Versions

All M6 Firmware versions before 7.1.0

All M5 Firmware versions before 9.0.0

Remediation/Fixes

M6

IBM QRadar SIEM

| 7.4| M6 7.6.1 ISO

IBM QRadar SIEM

| 7.4| M6 7.6.1 USB

IBM QRadar SIEM

| 7.5| M6 7.6.1 ISO
IBM QRadar SIEM| 7.5| M6 7.6.1 USB

M5

IBM QRadar SIEM

| 7.4| M5 9.0.0 ISO

IBM QRadar SIEM

| 7.4| M5 9.0.0 USB

IBM QRadar SIEM

| 7.5| M5 9.0.0 ISO
IBM QRadar SIEM| 7.5| M5 9.0.0 USB

Workarounds and Mitigations

None