P4500G2 - Spectre and Meltdown

[VRZ-David]

Hi *,

are there any advisories / guidelines regarding HPE StoreVirtual Storage (in my case P4500 G2) and Meltdown or Spectre?

Cheers

David

[Torsten.]

I have not seen any so far.

IMHO the risk is a "bad" process spying the memory, but you cannot run a foreign process or a browser on such a storevirtual system, hence the risk should be low.

Since this is a Proliant G6 model, there will be probably no BIOS update ...

[Kipp_Glover · Accepted solution]

HPE has posted information about this security issue on the HPE Vulnerability site:    www.hpe.com/info/security-alerts 

The Spectre and Meltdown issue is the top issue listed on this page.    You can click on a link to see the list of impacted products.     At the time of this post the HPE Storage products have not been added to this list.   They will be added shortly.  

For Store Virtual,  the product is not vulnerable -  The StoreVirtual product does not allow arbitrary code execution. 

[VRZ-David]

Thank you very much. That is the information I was looking for.

[Kipp_Glover]

Just a short follow-up,  the HPE Vulnerability site,  www.hpe.com/info/security-alerts has been updated with a list of impacted HPE Storage products.  

Cheers!
/Kipp

[Ashwin-Scindhe]

HPE Support recoomends to run a thrid party scanner to generate report to check for vulnerability.

Could anyone suggest any third party scanner and if have tested.

[Torsten.]

>> HPE Support recoomends to run a thrid party scanner 

Where did you get this information from?

Microsoft has a tool for windows, but you need to run it on the system itself.

This does not apply to a StoreVirtual system.