|
|
Reference
|
V3 Vector
|
V3 Base Score
|
V2 Vector
|
V2 Base Score
|
|---|---|---|---|---|
|
CVE-2017-5715
|
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
|
5.5
|
(AV:L/AC:M/Au:N/C:C/I:N/A:N)
|
4.7
|
|
CVE-2017-5753
|
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
|
5.5
|
(AV:L/AC:M/Au:N/C:C/I:N/A:N)
|
4.7
|
|
CVE-2017-5754
|
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
|
5.5
|
(AV:L/AC:M/Au:N/C:C/I:N/A:N)
|
4.7
|
|
CVE-2018-3693
|
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
|
5.5
|
(AV:L/AC:M/Au:N/C:C/I:N/A:N)
|
4.7
|
RESOLUTION
Intel has now granted the microcode update for certain G7 and G6 system ROM updates and they are available for download as of March 16, 2018. Intel has now granted the microcode update for certain Gen9 and Gen8 system ROM updates and they are available for download as of February 23, 2018. Intel has now granted the microcode update for Gen10 System ROM updates and they are available for download as of February 20, 2018.
On January 11, Intel announced issues with an increased frequency of reboots when using the microcodes they released to address Variant 2 of the Spectre Vulnerability for numerous processors including Broadwell, Haswell, Skylake, Kaby Lake, Ivybridge, and Sandybridge processors. Intel has now identified the root cause of these issues and determined that these microcodes may introduce reboots and other unpredictable system behavior. Due to the severity of the potential issues that may occur when using these microcodes, Intel is now recommending that customers discontinue their use. Additional information is available from Intel’s Security Exploit Newsroom here:
https://newsroom.intel.com/press-kits/security-exploits-intel-products/ 
All System ROMs including impacted microcodes were removed from the HPE Support Site. This impacts HPE ProLiant and Synergy, Gen9, and Gen8 v2 servers as well as HPE Superdome servers for which updated System ROMs had previously been made available. Intel is working on updated microcodes to address these issues, and HPE will validate updated System ROMs including these microcodes and make them available to our customers in the coming weeks.
Mitigations for Variant 1 (Spectre) and Variant 3 (Meltdown) vulnerabilities require only OS updates and are not impacted.
-
HPE has provided a customer bulletin https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-a00039267en_us with specific instructions to obtain the udpated sytem ROM
-
NonStop customers should carefully review all pertinent NonStop Hotstuff notices BEFORE taking any action.
-
Note:
- CVE-2017-5715 (Variant 2) and SpectreRSB require that the System ROM be updated and a vendor supplied operating system update be applied as well.
- For CVE-2017-5753, CVE-2017-5754 (Spectre variants 1, 1.2, NetSpectre and variant 3) require only updates of a vendor supplied operating system.
- For CVE-2018-3693 Spectre variant 1.1 Bounds Check Bypass Stores require only updates of a vendor supplied operating system.
- HPE will continue to add additional products to the list.
- Version:1 (rev.1) - 4 January 2018 Initial release
- Version:2 (rev.2) - 5 January 2018 Added additional impacted products
- Version:3 (rev.3) - 10 January 2018 Added more impacted products
- Version:4 (rev.4) - 9 January 2018 Fixed product ID
- Version:5 (rev.5) - 18 January 2018 Added additional impacted products
- Version:6 (rev.6) - 19 January 2018 updated impacted product list
- Version:7 (rev.7) - 23 January 2018 Marked impacted products with TBD for System ROM updates per Intel's guidance on microcode issues
- Version:8 (rev.8) - 24 January 2018 Added additional impacted products
- Version:9 (rev.9) - 25 January 2018 Added additional impacted products
- Version:10 (rev.10) - 25 January 2018 Added additional impacted products, adjusted CVSS score
- Version:11 (rev.11) - 1 February 2018 Added additional impacted products
- Version:12 (rev.12) - 13 February 2018 Updated NonStop Product information
- Version:13 (rev.13) - 16 February 2018 Removed not impacted product
- Version:14 (rev.14) - 22 February 2018 Updated Gen10 products (for Intel Skylake-SP) with released System Rom
- Version:15 (rev.15) - 2 March 2018 Updated certain Gen9, and Gen8 products, corrected CVSS vectors
- Version:16 (rev.16) - 6 March 2018 Added Gen6 and Gen7 Systems
- Version:17 (rev.17) - 17 March 2018 Updated nonstop information, added CVEs to title
- Version:18 (rev.18) - 19 March 2018 Added superdome flex resolution, added resolution for certain G6, G7 servers
- Version:19 (rev.19) - 30 March 2018 Added Cloudline products and adjusted ROM version names to match HPE Support Center
- Version:20 (rev.20) - 14 April 2018 Added certain AMD processor-based systems
- Version:21 (rev.21) - 8 May 2018 Updated Superdome X and Superdome Flex Version Information
- Version:22 (rev.22) - 29 June 2018 HPE will not provide microcode patches for certain ProLiant G6 Systems. Apply OS vendor patches to mitigate
- Version:23 (rev.23) - 23 July 2019 Added Spectre 1.1 Bounds Check Bypass Store CVE-2018-3693, added Spectre 1.2, SpectreRSB, NetSpectre - these are remediated by the fixes provided by OS vendors
- Version:24 (rev.24) - 5 May 2020 Added Moonshot m710x to impacted products list
Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com.
-
Web Form: https://www.hpe.com/info/report-security-vulnerability
-
Email: security-alert@hpe.com
Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive
System management and security procedures must be reviewed frequently to maintain system integrity. HPE is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.
"HPE is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HPE products the important security information contained in this Bulletin. HPE recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HPE does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HPE will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HPE disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
Hewlett Packard Enterprise est convaincu qu'il faut être inclusif sans condition. Les travaux de travaux de remplacement des termes non inclusifs dans nos produits actifs sont en cours.