QRadar M6 ThinkSystem firmware V9.0.0 for 1U and 2U appliances (ISO XClarity Controller remote installs)

Part 1: About the M6 firmware V9.0.0 update

The M6 firmware v9.0.0 ISO is intended to remotely update software through the XClarity Controller (XCC) user interface. Administrators must extract the EXE file and apply the uxz file to update their XClarity Controller, then the ISO can be mounted to apply the remainder of the firmware updates. The installation instructions are provided on tab named 'Part 2. Installing Firmware Updates'. These instructions guide customers through a remote upgrade of their firmware. If you are local to your appliances or have issues with your XClarity configuration, you can use the USB installation instructions for on-prem updates. For more information, see: M6 9.0.0 USB on-prem updates.

Important: If your appliance is in a HA pair, there are configuration steps required to set the status properly for your primary and secondary high-availability appliances. For more information, see: http://www.ibm.com/support/docview.wss?uid=swg27047121#HA.
 

Supported appliances, types, and model information

This firmware update applies to the following IBM Security QRadar M6 (1U and 2U form factor) appliance types:

Hardware	Details
Appliance and machine type model (MTM)	1U IBM QRadar Core Appliance XX05 G4 (4563-Q3E) IBM QRadar Event/QFlow Collector Appliance 1501/1201 G4 (4563-Q5D) IBM QRadar Network Insights Appliance 1901 G2 (4563-F8Y) IBM QRadar Network Insights Appliance 1910 G2 (4563-F7Y) IBM QRadar Core Appliance XX48 G2 (4563-Q5B) 2U IBM QRadar Network Insights Appliance 1920 G2 (4563-F5F) IBM QRadar Incident Forensics Appliance G4 (4563-F3A) IBM QRadar Core Appliance XX29 G2 (4563-Q4A) IBM QRadar Network Packet Capture Appliance G2 (4563-F3C)
Server Type	M6
Server Machine Type	SR630 / M6 1U SR650 / M6 2U

Table 1: List of appliances the M6 appliance firmware V9.0.0 can update.

Important information and prerequisites in this firmware update

• A number of hard disk drives can be installed in this appliance. The HDD update tool examines the hard disk drives that are present and selects the latest firmware version that is available for your drive.
• The base system pack might contain other firmware packages that are not present in QRadar appliances. Firmware updates from the base system pack can be listed when the tool compares available firmware to the hardware in the appliance and display a status of "undetected".
• For general firmware questions and information, see our FAQ page at http://ibm.biz/qradarfirmware.

Security issues resolved in this firmware update

The table lists the software versions and CVEs addressed in the firmware release.

Component	File name	Updates
UEFI/BIOS	lnvgy_fw_uefi_ive180i-3.42_anyos_32-64.uxz	Resolved CVEs CVE-2022-32231, CVE-2022-26343, Fixes Updated MCU to M9750653_01000161, MBF50656_04003303, and MBF50657_05003303 Updated SPS to SPS_E5_04_01_04_901_0
XCC	oem_fw_xcc_cdo3a2u-8.82_anyos_noarch.uxz	Resolved CVEs CVE-2015-3414, CVE-2015-3415, CVE-2015-3416, CVE-2016-6153, CVE-2017-3735, CVE-2017-3736, CVE-2017-3737, CVE-2017-3738, CVE-2017-5130, CVE-2017-6451, CVE-2017-6452, CVE-2017-6455, CVE-2017-6458, CVE-2017-6459, CVE-2017-6460, CVE-2017-6462, CVE-2017-6463, CVE-2017-6464, CVE-2017-7407, CVE-2017-8816, CVE-2017-8817, CVE-2017-10989, CVE-2017-12799, CVE-2017-12967, CVE-2017-13710, CVE-2017-14129, CVE-2017-14130, CVE-2017-14333, CVE-2017-14529, CVE-2017-14930, CVE-2017-14932, CVE-2017-14933, CVE-2017-14934, CVE-2017-14938, CVE-2017-14939, CVE-2017-14940, CVE-2017-14974, CVE-2017-15020, CVE-2017-15021, CVE-2017-15022, CVE-2017-15023, CVE-2017-15024, CVE-2017-15025, CVE-2017-15225, CVE-2017-15938, CVE-2017-15939, CVE-2017-15996, CVE-2017-16544, CVE-2017-16931, CVE-2017-16932, CVE-2017-17484, CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-1000494, CVE-2018-6872, CVE-2018-1000005, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122
LXPM	lnvgy_fw_lxpm_pdl142h-2.08_anyos_noarch.uxz	None
RAID controller	lnvgy_fw_raid_mr3.5.530-51.20.0-4374-0_linux_x86-64.bin lnvgy_fw_raid_mr3.5.930-51.20.0-4374-0_linux_x86-64.bin	None
HDD	lnvgy_fw_drives_all-1.39.11-0_linux_x86-64.bin	None
PCi and LOM adapters	ntc-lnvgy_fw_nic_net-8.70-5.70-1.3218.0-4_linux_x86-64.bin	None
Emulex	elx-lnvgy_fw_fc_lp.31-14.0.376.10-4_linux_x86-64.bin	None

Table 3: Security issues resolved in the M6 firmware update 9.0.0.

 

A. Before you begin

• This installation method uses the hardware's integrated XCC interface to remotely update firmware. If XCC network speeds are not sufficient, or the upgrade fails, use USB installation instead.
• Administrators must enable Ethernet over USB (called IMM.LanOverUsb in OneCLI config) on the ThinkSystem appliance before the firmware update is applied. For information on how to enable this setting, see https://www.ibm.com/support/pages/node/278761.
• If your appliances are in a HA pair, you must prepare your high-availability appliances by using the instructions found here: http://www.ibm.com/support/docview.wss?uid=swg27047121#HA .
• A number of hard disk drives can be installed in this appliance. The HDD update tool examines the hard disk drives that are present and selects the most current firmware level that is available.

B. Downloading and extracting the firmware update

1. Download the QRadar M6 appliance firmware from IBM Fix Central for QRadar 7.5.x: IBM Fix Central M6 firmware 9.0.0 EXE.
   Note: Administrators can select either download link as the firmware download is identical for all QRadar versions.
2. Copy the M6 appliance firmware EXE to a directory on the Windows host.
3. Double-click the file Qradar_EXE_M6_1U_SR630_7X02_2U_SR650_7X06_9_0_0.exe.
4. Select or type a directory path for the firmware update and click Extract.
   
5. The following files are extracted:
   

C. Updating the XCC firmware

1. Log in to the XClarity interface on your QRadar M6 appliance.
2. From the navigation sidebar, click Firmware Update.
   
3. Click Update Firmware.
   
4. Click Browse and select the XCC firmware update file: oem_fw_xcc_cdo3a2u-8.82_anyos_noarch.uxz.
   
5. Click Next to upload and verify the XCC firmware file.
   
6.  Select the BMC (Primary) check box and click Next.
   Important: The backup firmware bank is automatically updated in the background after the host is running stable on the primary bank. It could be several weeks before the backup is updated. Administrators must ensure the BMC (Backup) check box is not selected.
   
7. Wait for the update the primary firmware banks to complete.
   
8. Click Restart BMC and clear your browser cache.
   
   
   Results
   Wait for 5 minutes for the XCC interface to restart and log in. Continue to the next section to mount the firmware ISO and configure the boot options.

D. Mounting the M6 Firmware ISO

 

1. From the OEM Controller menu, click Remote Console.
2. Click Remote Console Preview.
   IMPORTANT: Confirm the following parameters:
   1. Launch the session in Single User Mode.
   2. Clear the Allow others to request my remote session disconnect check box.
   3. Click Launch Remote Console to connect to the appliance.
3. To boot to the QRadar firmware ISO, click Media to mount the ISO image.
   
4. Click Activate.
   
5. Click Browse and select Qradar_ISO_M6_1U_SR630_7X02_2U_SR650_7X06_9_0_0.iso that was extracted previously.
6. Click Mount all local media.
   Note: If successful, a check mark appears next to the uploaded ISO file.
   
7. Select Power > Restart Server Normally
   
8. When the machine powers back on, press F12 to select F12: One Time Boot Device.
   Note: The field F12: One Time Boot Device displays with a blue background to indicate the virtual keyboard is selected.
   
9. Optional. If the F12: One Time Boot Device field is not selected, launch the virtual keyboard to press the F12 key.
   
10. From the Boot Devices Manager menu:
    1. In the Legacy Mode field, press the Space Bar to clear the value. Legacy Mode is selected by default and you must be clear the value before you continue.
    2. Select XCC Virtual Media and press Enter.
       
11. The Lenovo XClarity Essentials UpdateXpress tool is launched.
12. In the Setting menu, confirm that all values are clear (not selected), then click Next.
    
13. From the Update Comparison menu, click Begin.
    
14. The IBM UpdateXpress System Pack Installer compares the current package with the installed firmware.
15. Review the list of updates.
    Important: In the next step, administrators must confirm that all recommended updates that have a newer version available are CHECKED.
    Lenovo XClarity Controller XCC must not be selected (checked) as this firmware was updated manually by the administrator in previous steps.
16. Scroll down and verify the check box for Lenovo XClarity Controller (XCC) is clear (not selected) and click Next.
    
17. Wait for the firmware updates to load.
18. Click Begin Update to install the firmware.
    
    
    NOTE: Administrators might be prompted with a confirmation dialogue and need to click Yes to continue.
19. Verify that all updates complete successfully and click Next.
20. Click Finish, then Yes to exit.
    Note: You might be required to scroll down to view the Finish button.
    
21. The appliance must reboot to complete the firmware installation.
    Note: Depending on your current firmware versions, the appliance might reboot multiple times to apply required updates.
    
22. After the system boots, click Media
    
23. Click Deactivate to unmount the ISO and disable the virtual media.
    
24. Close the Mount Virtual Media window and allow the host to continue to boot normally.
    
    Results
    After the ISO file is unmounted, the administrator can log out and complete this procedure on other QRadar appliances. If you experience any installation issues, you can contact QRadar Support for assistance and open a software support case for your appliance. The support representative can request the firmware logs for review to determine the root cause of the issue or if replacement hardware is required. If the issue is hardware-related, the support representative can change the case type and involve the proper teams to schedule replacement parts.