IBM Support

Security Bulletin: Linux Kernel as used by IBM QRadar SIEM contains multiple vulnerabilities

Security Bulletin


Summary

Linux Kernel as used by IBM QRadar SIEM contains multiple vulnerabilities

Vulnerability Details

CVEID:   CVE-2020-12362
DESCRIPTION:   Intel Graphics Drivers could allow a local authenticated attacker to gain elevated privileges on the system, caused by an integer overflow in the firmware. An attacker could exploit this vulnerability to gain elevated privileges on the system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/196564 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2020-12363
DESCRIPTION:   Intel Graphics Drivers are vulnerable to a denial of service, caused by improper input validation. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 1.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/196581 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2020-12364
DESCRIPTION:   Intel Graphics Drivers are vulnerable to a denial of service, caused by a NULL pointer reference error. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 1.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/196582 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)

CVEID:   CVE-2020-27170
DESCRIPTION:   Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by an out-of-bounds loads flaw. By executing specially-crafted BPF programs, an attacker could exploit this vulnerability to obtain contents of kernel memory, and use this information to launch further attacks against the affected system.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/198453 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:   CVE-2020-8648
DESCRIPTION:   Linux kernel could allow a remote attacker to obtain sensitive information, caused by a use-after-free in the n_tty_receive_buf_common function of drivers/tty/n_tty.c. An attacker could exploit this vulnerability to read memory that should not be available for access.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/175843 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:   CVE-2021-3347
DESCRIPTION:   Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a kernel stack use-after-free during fault handling in PI futexes. An attacker could exploit this vulnerability to gain elevated privileges and execute arbitrary code in the kernel.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/195798 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2020-24489
DESCRIPTION:   Multiple Intel Virtualization Technology for Directed I/0 (VT-d) products could allow a local authenticated attacker to gain elevated privileges on the system, caused by an incomplete cleanup. An attacker could exploit this vulnerability to gain elevated privileges on the system.
CVSS Base score: 8.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/203350 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

CVEID:   CVE-2020-24511
DESCRIPTION:   Intel Processors could allow a local authenticated attacker to obtain sensitive information, caused by improper isolation of shared resources. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 5.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/203398 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:   CVE-2020-24512
DESCRIPTION:   Intel Processors could allow a local authenticated attacker to obtain sensitive information, caused by the observable timing discrepancy issue. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 2.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/203396 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N)

CVEID:   CVE-2020-24513
DESCRIPTION:   Intel Atom could allow a local authenticated attacker to obtain sensitive information, caused by domain-bypass transient execution vulnerability. A local attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 5.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/203407 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)

Affected Products and Versions

IBM QRadar SIEM 7.3.0 to 7.3.3 Fix Pack 9

IBM QRadar SIEM 7.4.0 to 7.4.3 Fix Pack 2

Remediation/Fixes

QRadar / QRM / QVM / QRIF / QNI 7.3.3 Fix Pack 10

QRadar / QRM / QVM / QRIF / QNI 7.4.3 Fix Pack 3

QRadar / QRM / QVM / QRIF / QNI 7.4.3 Fix Pack 4

Note: Version 7.4.3 Fix Pack 3 is only available to QRadar on Cloud users. QRadar 7.4.3 Fix Pack 3 was removed for on-premise QRadar SIEM users.

Workarounds and Mitigations

None

Get Notified about Future Security Bulletins

References

Off

Change History

26 Nov 2021: Initial Publication

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Component":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3, 7.4","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
03 December 2021

UID

ibm16520482