topic Re: DL360 Gen9 firmware update for meltdown/spectre? in ProLiant Servers (ML,DL,SL)

DL360 Gen9 firmware update for meltdown/spectre?

Daniel13 — Fri, 05 Jan 2018 09:42:51 GMT

HP released a new firmware version 3rd of January, and in the "Fixes" section it says: "Updated the Intel processor microcode to the latest version".

Is this the fix for the meltdown and spectre vulnerabilities?

https://support.hpe.com/hpsc/swd/public/detail?sp4ts.oid=7252838&swItemId=MTX_cf6657e373254295b51b2e368a&swEnvOid=4184#tab5

https://support.hpe.com/hpesc/public/home/driverHome?sp4ts.oid=7252838

Re: DL360 Gen9 firmware update for meltdown/spectre?

oakwood — Fri, 05 Jan 2018 12:03:48 GMT

We're also trying to hunt down the confirmed patches. I'm quite surpised there is nothing on the front page about this, with it being such a big deal! Seems every other vendor is all over it.....

HPE, we need some help here pretty quick please.,

Re: DL360 Gen9 firmware update for meltdown/spectre?

HPSDMike — Fri, 05 Jan 2018 13:35:26 GMT

Hello All, new information is continuing to be available frequently on this topic. Please visit the following sites for the most accurate info:

https://www.hpe.com/us/en/services/security-vulnerability.html

https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_us

https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-a00039267en_us

The information, and links, on these pages will link you to appropriate info and patches as they become available.

Re: DL360 Gen9 firmware update for meltdown/spectre?

Peter stratman — Fri, 05 Jan 2018 13:48:42 GMT

Great, thank you for the pointers.

However, how about pre-GEN9 servers ?

Re: DL360 Gen9 firmware update for meltdown/spectre?

Kissel-B — Fri, 05 Jan 2018 14:25:06 GMT

What About Gen 7 and lower servers are they going to receive a patch as well.

Re: DL360 Gen9 firmware update for meltdown/spectre?

HPSDMike — Fri, 05 Jan 2018 14:38:53 GMT

Please keep an eye on those URLs as that is where official communication will come from. I don't have any information on timing and availability for Pre Gen9 products.

Re: DL360 Gen9 firmware update for meltdown/spectre?

MorbrosIT — Fri, 05 Jan 2018 16:13:32 GMT

Looks like 1/12/18 is when to lookout for the Gen8 patches.

Re: DL360 Gen9 firmware update for meltdown/spectre?

Peter stratman — Fri, 05 Jan 2018 16:38:43 GMT

Given the fact that processors released since 1995 are impacted, I would think everything since G1 needs the updates.

Re: DL360 Gen9 firmware update for meltdown/spectre?

tciecka-CTI — Mon, 08 Jan 2018 15:23:08 GMT

@MorbrosIT

Where did you see 1/12/2018? I haven't been able to find it in any of the links I've followed from this page:

https://www.hpe.com/us/en/services/security-vulnerability.html

Re: DL360 Gen9 firmware update for meltdown/spectre?

Torsten. — Mon, 08 Jan 2018 16:47:25 GMT

https://support.hpe.com/hpsc/swd/public/detail?sp4ts.oid=1009087943&swItemId=MTX_619387df72814a09a6baa555e8&swEnvOid=4184#tab-history

Version: 2.54_12-07-2017(3 Jan 2018)

Re: DL360 Gen9 firmware update for meltdown/spectre?

Denis_Dordoigne — Tue, 09 Jan 2018 08:28:56 GMT

Last bulletin provide a solution for Gen8 servers, « update to a System ROM version dated 12/12/2017 », but the latest system ROM avaiable is dated 24 Oct 2016...

Re: DL360 Gen9 firmware update for meltdown/spectre?

Torsten. — Tue, 09 Jan 2018 09:25:10 GMT

It alwas takes a few days until a published version appears on the web pages. The Gen9 and Gen10 updates are obviously already available.

Re: DL360 Gen9 firmware update for meltdown/spectre?

simonb — Tue, 09 Jan 2018 10:56:48 GMT

When adding this patch for vmware hosts to SUM - I just get component not signed and cannot progress further...any thoughts?

Re: DL360 Gen9 firmware update for meltdown/spectre?

AlecKeeler — Wed, 10 Jan 2018 10:39:22 GMT

Seems a bit wrong for a security vulnerability to announce it as available then have a process where it takes days for it to be available to download from the support website. If its critical as described by HP in the bulletin it should be available as soon as possible

Alec Keeler, release engineer Nexor

Re: DL360 Gen9 firmware update for meltdown/spectre?

AlecKeeler — Wed, 10 Jan 2018 10:46:05 GMT

From https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-a00039267en_us

"For ProLiant Gen8 series servers, update to a System ROM version dated 12/12/2017."

Is there a direct link available to be able to download this BIOS ?

Alec Keeler, release engineer, Nexor Ltd

Re: DL360 Gen9 firmware update for meltdown/spectre?

tato386 — Sun, 14 Jan 2018 14:41:09 GMT

Did they pull the 2.54 BIOS? I can get to the page but there is no download button?

Re: DL360 Gen9 firmware update for meltdown/spectre?

AlecKeeler — Mon, 15 Jan 2018 09:47:56 GMT

Yep apparently Intel changed some microcode

https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-a00039267en_us

Currently they are saying roll back to 2.52 if you did put 2.54 on

Alec

Re: DL360 Gen9 firmware update for meltdown/spectre?

JeroenKleen — Wed, 31 Jan 2018 13:22:46 GMT

At this moment it might be good to wait as we might be releasing very soon a new ROMBIOS fix: http://h22208.www2.hpe.com/eginfolib/securityalerts/SCAM/Side_Channel_Analysis_Method.html

Best regards, Jeroen

Re: DL360 Gen9 firmware update for meltdown/spectre?

AlecKeeler — Fri, 02 Feb 2018 05:55:11 GMT

Thanks for the update, so still waiting for the new BIOS,

RedHat by the way have RHSA's available now for RHEL 6 and 7, the ones for the Extended Life Cycle Support for RHEL5 are still pending

https://access.redhat.com/security/vulnerabilities/speculativeexecution

Our products are RHEL appliances on DL360 platforms, we span from G5 to Gen9 on the hardware (mostly 8 &9) and RHEL5 and RHEL6 for the OS, hence our interest in resolving this

Alec