Security Bulletin: Multiple Vulnerabilities in Intel Processors affect IBM Cloud Pak System

Summary

Multiple Vulnerabilities in Intel Processors affect IBM Cloud Pak System. IBM Cloud Pak System has addressed these vulnerabilities.

Vulnerability Details

**CVEID:**CVE-2021-0091 DESCRIPTION: Intel Processors could allow a local attacker to gain elevated privileges on the system, caused by improper access control in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 3.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219044 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N)

**CVEID:**CVE-2021-0092 DESCRIPTION: Intel Processors are vulnerable to a denial of service, caused by improper access control in the firmware. By executing a specially-crafted program, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219043 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H)

**CVEID:**CVE-2021-0093 DESCRIPTION: Intel Processors are vulnerable to a denial of service, caused by incorrect default permissions in the firmware. By executing a specially-crafted program, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 2.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219042 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)

**CVEID:**CVE-2021-0099 DESCRIPTION: Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by insufficient control flow management in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219079 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

**CVEID:**CVE-2021-0103 DESCRIPTION: Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by insufficient control flow management in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 8.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219078 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

**CVEID:**CVE-2021-0107 DESCRIPTION: Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by unchecked return value in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219041 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N)

**CVEID:**CVE-2021-0111 DESCRIPTION: Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by a NULL pointer dereference in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219040 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N)

**CVEID:**CVE-2021-0114 DESCRIPTION: Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by an unchecked return value in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219077 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

**CVEID:**CVE-2021-0115 DESCRIPTION: Intel Processors are vulnerable to a buffer overflow, caused by improper bounds checking by the firmware. By executing a specially-crafted program, a local authenticated attacker could overflow a buffer and escalate privileges.
CVSS Base score: 7.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219076 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

**CVEID:**CVE-2021-0116 DESCRIPTION: Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by an out-of-bounds write in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219075 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

**CVEID:**CVE-2021-0117 DESCRIPTION: Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by pointer issues in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219074 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

**CVEID:**CVE-2021-0118 DESCRIPTION: Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by an out-of-bounds read in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219073 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

**CVEID:**CVE-2021-0119 DESCRIPTION: Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper initialization in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 5.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219039 for the current score.
CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L)

**CVEID:**CVE-2021-0124 DESCRIPTION: Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper access control in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 6.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219038 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H)

**CVEID:**CVE-2021-0125 DESCRIPTION: Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper initialization in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 6.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219027 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L)

**CVEID:**CVE-2021-0156 DESCRIPTION: Intel Processors could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper input validation in the firmware. By executing a specially-crafted program, an attacker could exploit this vulnerability to escalate privileges.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219072 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)

**CVEID:**CVE-2021-0127 DESCRIPTION: Intel processors are vulnerable to a denial of service, caused by insufficient control flow management. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219024 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H)

**CVEID:**CVE-2021-0145 DESCRIPTION: Intel processors could allow a local authenticated attacker to obtain sensitive information, caused by improper initialization of shared resources. An attacker could exploit this vulnerability to obtain sensitive information and use this information to launch further attacks against the affected system.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/219023 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

For unsupported release/version/platform IBM recommends to upgrade to supported fixed release of the product.

Recommended Firmware updates are listed in the table below. Firmware has been updated with IBM Cloud Pak System v2.3.3.5.

For IBM Cloud Pak System v2.3.0.1, v2.3.1.1, v2.3.2.0, v2.3.3.0, v.2.3.3.1, v.2.3.3.2, v.2.3.3.3, v2.3.3.3 Interim Fix 1, v2.3.3.4

upgrade to IBM Cloud Pak System v2.3.3.5 at Fix Central

Information on upgrading : http://www.ibm.com/support/docview.wss?uid=ibm10887959

Workarounds and Mitigations

None