Cyber Defense eMagazine May Edition for 2022

across 12 categories. For example, some of the top hardware weaknesses include CWE-1189 Improper
Isolation of Shared Resources on System-on-a-Chip, CWE-1191 On-Chip Debug and Test Interface with
Proper Access Control, and CWE-1231 Improper Prevention of LockBit Modification. The complete list
can be found here at MITRE.
Now let’s dive into five key learnings from the Intel 2021 Product Security Report:
1. 226 total CVEs were mitigated in 2021. Intel’s proactive product security assurance efforts
discovered 93%, which is a percentage increase year-over-year since 2019. This occurs
through red team events, extensive internal and external code reviews, and through
collaboration with external researchers who report vulnerabilities to Intel’s bug bounty programs.
2. Of the 226 CVEs, Intel employees found 50% of them (or 113 CVEs). And of the remaining 113
CVEs reported by external researchers, 86% (or 97 CVEs) were reported through Intel’s Bug
Bounty program. Intel’s efforts to internally identify and mitigate vulnerabilities has continued to
increase over the last three years.
3. 77% of hardware/firmware vulnerabilities were found by Intel (up from 69% in 2020), while 70%
(down from 83% in 2020) of software issues were found by external researchers. This is the
result of continued investment by Intel to harden the security of its products, plus additional
collaboration with researchers through new programs like Project Circuit Breaker, an expansion
of Intel’s Bug Bounty program.
4. Collaboration with external researchers remains essential to Intel’s security assurance strategy,
contributing to the discovery of CVEs across a variety of categories. That data is then fed back
into Intel’s security development lifecycle (SDL) and helps inform where to focus additional
efforts such as hackathons.
5. Intel compared CVE counts to AMD in two primary areas: CPUs and Graphics. Of the 16 Intel
CPU and 51 Graphics vulnerabilities found in 2021, 25 were discovered internally by Intel (and
42 were found through Intel’s Bug Bounty program). According to AMD’s publicly available
information, 31 AMD CPU and 27 Graphics vulnerabilities were disclosed in 2021 and all were
attributed by AMD to external sources. Notably, Intel and AMD share 23 of the Graphics CVEs,
as these were issues reported through Intel’s Bug Bounty program, but the affected graphics
components were AMD parts integrated into Intel products.
Intel continues to heavily invest in security assurance. This includes its Security Development Lifecycle
(SDL), which guides the company in applying privacy and security practices across hardware and
software (including firmware) throughout the product lifecycle. Furthermore, the community of security
researchers from around the world continues to contribute to improving the security of Intel technology
through Intel’s Bug Bounty program. And just recently the company announced Project Circuit Breaker,
the next expansion within its Bug Bounty program comprised of a community of elite hackers hunting
bugs in firmware, hypervisors, GPUs, compromising chipsets, pwning processors and more.
Cyber Defense eMagazine – May 2022 Edition 36
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.