Side-Channel Analysis Method (Spectre & Meltdown) Security Review

Side-Channel Analysis Method

(Spectre & Meltdown) Security Review

Fujitsu Communication

Latest Update: 25.06.2018

Reference: Intel security vulnerabilities(CVE 2017- 5715, CVE 2017- 5753, CVE 2017- 5754, SA-00088)

Malicious code utilizing a new method of side-channel analysis and running locally on a normally operating platform has the potential to allow the inference of data values from memory. This issue takes advantage of techniques commonly used in many modern processor architectures.

Impact:

Elevation of Privilege / Information Disclosure

The exploits do not have the potential to corrupt, modify or delete data.

Affected Fujitsu products:

A number of Fujitsu products are affected by these vulnerabilities. Fujitsu is working to distribute patches for all affected products that are currently supported. Older systems that are no longer supported will not be patched.

An overview of the affected Client Computing Devices can be found here:

Intel has notified that the microcode updates they have provided with OEMs have a problem which might cause reboot issues and unpredictable system behaviour.

https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-fr

Fujitsu is working with Intel on new BIOS. We will issue the updated BIOS as soon as possible once Intel reissues microcode updates.

*1: Dates are subject to change
*2: Please apply mentioned version or newer version.

CVE Reference:

Side-Channel Analysis Method

Technical Details:
Technical details of the exploits are documented online:

• https://meltdownattack.com/
• https://www.kb.cert.org/vuls/id/584653
• https://security-center.intel.com/

Mitigation:

Fujitsu strongly advises all customers to update affected products. Updates are provided through an updated version of the BIOS and the necessary patches for the dedicated operating system.

Update via BIOS:

Step 1:
Determine whether you have an affected system.
Refer to the list of affected Fujitsu systems. This list is updated regularly.
Before proceeding, please check the expected availability of the relevant BIOS update package.

Step 2:
Download and install the BIOS update package.
To install and download the BIOS update package, please go to the Fujitsu support page and follow these steps:

1. Select “Product Type”.
2. Select “Series”.
3. Select “Model”.
4. Select “OS”.
5. Download the latest BIOS update package from the “BIOS” section and install it.

Selected links for operating system patches:

• Microsoft Windows
  https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV180002

Note:

This is a non-binding communication that is not intended to create, and shall not be construed as creating, a legal obligation or commitment of Fujitsu or its suppliers. All details of this communication have been prepared with care, based on the information available to Fujitsu at the time of publication. However, all details of this communication are subject to error or change, depending on further findings. Websites of other companies referred to in this communication are the sole responsibility of such other companies. Fujitsu assumes no liability with respect to the information provided on such websites. Designations may be trademarks and/or copyrights of Fujitsu or the respective companies, the use of which by third parties for their own purposes may infringe the rights of such owners.