Microprocessor Side-Channel Vulnerabilities (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754): Impact on Dell EMC Servers, Storage and Networking

Question: How can I protect against these vulnerabilities?
Answer: There are three vulnerabilities associated with Meltdown and Spectre. Customers must deploy an OS patch from their OS vendor for all 3 vulnerabilities. Only Spectre Variant 2 (CVE-2017-5715) requires a BIOS update with the processor vendor provided microcode. At this time, Intel does not yet have a microcode update available to protect against the Spectre Variant 2 vulnerability.

See table below:
 

Variant to Patch	Microcode Update Needed?	OS Patch Needed?
Spectre (Variant 1) CVE-2017-5753	No	Yes
Spectre (Variant 2) CVE-2017-5715	Yes	Yes
Meltdown (Variant 3) CVE-2017-5754	No	Yes

Question: What is the Dell EMC current recommendation regarding updating the OS patches?
Answer: Please refer to your OS vendor’s patch guidance links.

Question: Does Dell EMC have a list of Enterprise products that are not affected?
Answer: Dell EMC has a list of Enterprise products that are not currently affected - look here.

Question: What do I do if I run a virtual server?
Answer: Both the hypervisor and all guest OS’ need to be patched.

Question: Are internet browsers potentially affected? (JavaScript Variant 2 exploit)?
Answer: Yes internet browsers can be affected by the Spectre vulnerability and most browsers have provided updated versions or patches to mitigate this potential vulnerability. See links below for Chrome, Internet Explorer, & Mozilla for additional information.

Question: What about iDRAC and PERC?
Answer: Both the PERC and iDRAC are closed systems that do not allow 3rd party (user) code to run. Spectre and Meltdown both require the ability to run arbitrary code on the processor. Due to this closed code arrangement neither peripheral is at risk of a side-channel analysis microprocessor exploit.

Question: What about appliances? Are there other applications that aren't affected?
Answer: Closed systems that do not allow 3rd party (user) code to run are not vulnerable.

Question: What about the AMD Opteron processors?
Answer: https://www.amd.com/en/corporate/speculative-execution.

Question: When will the BIOS with microcode updates available from Dell EMC for Intel based systems?
Answer: Updated BIOSes that contain the Intel microcode security updates are available for PowerEdge 14G, 13G, 12G,  some of the 11G systems.

Question: When will BIOS be available for converged infrastructure running on PowerEdge technology (VXRail, etc.)
Answer: Dell EMC is working to validate existing PowerEdge code updates for all converged infrastructure platforms running on PowerEdge technology. Updates will be provided as additional information is available.

Question: Will Dell EMC be factory installing the operating system and hypervisor patches for PowerEdge Servers and converged infrastructure?
Answer: As of March 6, 2018, Dell is factory installing the following versions of OS updates to help mitigate the Spectre/Meltdown vulnerabilities.  These are configured (where possible) for maximum protection (fully enabled).  In some cases, there are newer updates provided by the vendors.  Please continue to refer to the OS vendor websites for specific configuration guidance and newer updates and configuration options as they become available.  

Question: I've heard that the vulnerability affects microprocessors going back at least 10 years. How far back is Dell offering a BIOS update?
Answer: Dell is working with Intel to provide the required BIOS with microcode patches for PowerEdge systems going back to our 11th generation product line. Any BIOS updates that contain microcode updates for the security fix will be dependent upon the affected processor vendors providing code updates to Dell EMC.

Question: Will Dell EMC provide technical support for systems that are out of warranty?
Answer: Dell EMC does not provide technical support for Dell EMC PowerEdge servers that do not have a valid support contract. Customers can access publically available support documents on Dell Support regardless of current support contract status.

Question: Will Dell EMC provide patches for systems that are out of warranty?
Answer: Dell EMC PowerEdge server products do not require a valid support contract in order to gain access to our support and downloads pages. PowerEdge server BIOS updates will be available on the Dell EMC support site to all users regardless of current support contract status. Refer to the BIOS section here for BIOS availability. OS patches should be obtained from your OS provider - links are here.

Question: What about the new AMD EPYC processors?
Answer: For AMD public statements on Meltdown (CVE-2017-5754) Spectre Variant 1 (CVE-2017-5753) and Spectre Variant 2 (CVE-2017-5715) as they relate to AMD processors, see https://www.amd.com/en/corporate/speculative-execution.
For Spectre Variant 1 (CVE-2017-5753) the applicable OS patch will address this issue.

Question: When will BIOS updates be available for AMD EYPC based PowerEdge systems that are affected by Spectre?
Answer: Dell EMC has released BIOS updates for our 14G platforms (R7425, R7415, & R6415) which are available on our product support pages. Factory install of these BIOS were available on January 17, 2018.

Question: When will the BIOS with Intel microcode updates be factory installed on the Intel based PowerEdge systems?  
Answer: PowerEdge 14G and 13G (except R930) BIOS is targeted to be available via factory install on March 6, 2018.  PowerEdge R930 BIOS is targeted to be available via factory install by March 9, 2018.

Question: Is there a performance impact from these BIOS and OS updates?
Answer: The key aspect of these attacks relies on speculative execution which is a performance-related feature. Performance impacts will vary since they are highly workload dependent. Dell is working with Intel and other vendors to determine performance impacts as a result of these updates and will address this once available.