LiveActive security incident?Get immediate response
CVE Record

CVE-2021-0127: Insufficient control flow management in some Intel(R) Processors may allow an authenticated user to potenti...

Insufficient control flow management in some Intel(R) Processors may allow an authenticated user to potentially enable a denial of service via local access.

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a local denial-of-service issue in some Intel processors. An already-authenticated local user could potentially trigger a condition that affects system availability. The public bundle does not show confidentiality or integrity impact, remote exploitability, or active exploitation.

Executive priority

Handle through normal vulnerability management, with priority for shared systems, critical infrastructure, and platforms where many users have local access. It is not shown as remotely exploitable or actively exploited in the provided sources.

Technical view

CVE-2021-0127 is described as insufficient control flow management in some Intel processors. CVSS 3.1 is 5.5: local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high availability impact only.

Likely exposure

Exposure depends on whether an organization uses Intel processor models covered by Intel SA-00532 or vendor advisories such as NetApp NTAP-20220210-0008. The bundle does not enumerate affected processor versions or downstream product mappings.

Exploitation context

The CVE requires local access by an authenticated user. KEV status is false in the bundle, and no cited source here establishes active exploitation. Treat it mainly as local availability risk until vendor-specific evidence says otherwise.

Researcher notes

The strongest available facts are the CVSS vector and Intel description. No CWE is listed, affected versions are deferred to references, and the bundle does not provide exploit details, proof-of-concept status, or specific fixed versions.

Mitigation direction

  • Review Intel SA-00532 for affected processor models and vendor-directed remediation.
  • Check OEM, server, appliance, and cloud-provider guidance for applicable firmware or microcode updates.
  • Review NetApp NTAP-20220210-0008 if NetApp systems are in scope.
  • Limit local shell or administrative access to trusted users where feasible.
  • Schedule remediation through normal firmware maintenance windows after vendor applicability is confirmed.

Validation and detection

  • Inventory Intel processor models across servers, workstations, appliances, and virtualized hosts.
  • Compare inventoried models against Intel SA-00532 and relevant OEM advisories.
  • Check firmware, BIOS, and microcode status against vendor guidance.
  • For NetApp environments, confirm product impact using the NetApp advisory.
  • Document systems not affected because their processor or vendor product is out of scope.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-0127 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2021-0127Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aIntel(R) ProcessorsSee referencesListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.