Intel Spectre/Meltdown BIOS Update planned for the Nehalem DL160 G6 Series?

[FIEK]

Is there a forthcoming BIOS update planned for the ProLiant DL160 G6 series (e.g. E5504 - Nehalem)?

E.g. ProLiant DL380 G6 (E5504 - Nehalem) has the latest Intel Spectre/Meltdown code in 2018.02.22 released in March 2018.

According to the latest Product Security Vulnerability Alert - https://h22208.www2.hpe.com/eginfolib/securityalerts/SCAM/Side_Channel_Analysis_Method.html Side Channel Analysis Method allows information disclosure in Microprocessors (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754)  it is not currently listed.

Thanks,

Fiek

[DANDKS]

Hi,

Currently the DL160 G6 server is not under the affected models.

Please refer to the below links for the affected HPE server models. The Microcode will be released only for the affected models & the links are shared in the below document.

http://h22208.www2.hpe.com/eginfolib/securityalerts/SCFM/Side_Channel_Downloads.html

Thank you.

[FIEK]

Well HPE have finally added the DL160 G6 and other DL1xx,ML1xx,SL1xx Series to both Side Channel Analysis and Variant Vulnerabilities bulletins on the 28th June;

"HPE will not provide patched microcode: HPE recommends customers mitigate the vulnerability by applying OS patches"

Not quite sure how this will protect systems that are vulnerable without the microcode patches (which are available from Intel e.g. Nehalem [02 April] in Production/Beta [22 June]) as the OS patches do not fully protect without the microcode being updated?

In a MS Windows environment;

"Important Customers who install only the Windows security updates will not receive the benefit of all known protections.

In addition to installing the latest Windows security updates, a processor microcode update is required. This should be available through your OEM."

If MS release the microcode independant of HPE then this may resolve it; KB4090007: Intel microcode updates

Fiek