Meltdown/Spectre Intel bug

[89u2]

i'm still wating for update for my HP Compaq dc7800 Small Form Factor

https://support.hp.com/us-en/document/c05869091

[Skylarking]

The "HPSBHF03573 rev. 4- Side-Channel Analysis Method" document does not reference many many vulnerable systems that HP has sold.

Lke you, i'm living in a HP induced vacumm. My z210 workstation is not referenced in HP's document, despite this document being prominently displayed when i go to HP support page for my z210. And I expect you have exactly the same issue as your dc 7800 seems not to be referenced 

So, i have no idea when/if HP will will do what is needed by pushing out a BIOS update (containing updated Intel microcode) to fix the vulnerable system they sold me.

It simply seems that HP does not care since they seem uninterested in communicating what they are doing about Meltdown & Spectre for many many of us.

So, despite what HP states in within this "Side-Channel" document; your security doesn't matter, only HP's bottom line matters.

The problem may be that HP isn't pushing Intel to do the correct thing; fix the CPU's Intel supplied to HP by releasing a microcode update so HP can fix the systems containing the faulty CPU's they sold to us by releasing a BIOS fix. 

Maybe they hope many will simply replace their functional working system rather that HP spend some dime testing a microcode update process (which we all know works as it has been done before many times via BIOS update).

Guess it's fair to say i'm peeved

[89u2]

i don't know how to update

https://support.hp.com/us-en/drivers/selfservice/hp-compaq-dc7800-small-form-factor-pc/3459241

Microcode Update for HP 786F BIOS Family Computers with Intel Processors

[Skylarking]

@98u2 , if you click on the "BIOS" text within the dc7800 support  link you provided, it will expand and list the latest available BIOS updates. You can further click on "see full details" for more info and further click on "associated files" and then "download" the release notes and read... 

The latest available BIOS update for your system is v1.35 dated 27 November 2015 (and this will include the earlier microcode update v1.14 dated 21 December 2010).

Sadly, nothing has yet been released to resolve the Spectre class of vulnerability on your system. Your system may or may not be included in HP's plans to resolve this class of  vulnerabilities.

So, from the dc7800 support link you provided, you should notice a pop-up in the top left of the page. Click on the "HP has released a security bulletin for systems with Intel x86 processor" and you can search the associated "HPSBHF03573 rev. 4 - Side-Channel Analysis Method" document for your system - hint: you wont find it.

As such, it looks like you are in the same place as me, that is you are in the dark re Spectre since HP has no plans to update your systems

But much of this info has been provided earlier (some of it by yourself) so i'm not sure what the problem is that you have.

If you have BIOS v1.35 installed on your system, you are up to date and nothing more can be done. If you have an earlier BIOS version, simply download the BIOS and double click on the softpack sp73582.exe and follow the pronmpts.

But i suspect you are up to date and just wonder why HP is no longer fixing vulnerabilities with your system.

It simply looks like you have an orphaned product in HP's view. All you can do now is complain to HP support and make noise about it. With enough noise from customers, HP may re-evaluate.

Just don't hold your breath and remember to breath.

As a parting note, i'm not across your system but possibly your system also has ME issues, i don't know. All i know is that if impacted and HP planned corrective action, ME updates would have occured mid last year so there should be a later BIOS than what is showing on HP dc7800 support page (if HP cared). Sadly the lastest BIOS for your system is late 2015 which predates any ME fixes. Again, it may be that ME issues didn't ima[ct your DC7800, i don't know.

So, may be your DC7800 has other vulnerabilities and it's not just Spectre you are waiting for...

[89u2]

why i don't see "HP Compaq dc7800 Small Form Factor" listed on https://support.hp.com/us-en/document/c05869091 ?

[Skylarking]

From the document you linked, read the statement "At HP we take security very seriously". Now  combine this with the fact that no reference is made to your system, or many other impacted systems. This should sum up the situation as to how HP is treating its customers/handling this issue. The other OEM's are a little better at communication (but not much better).

Sort of reminds me of the tv add many many years ago where Wang stated within the add that "Wang cares"... sadly it didn't have the meaning Wang hoped for in New Zealand...

Likely, HP and other OEM's handling of these vulnerabilities will be remembered in a similar vein to the Wang add for many years to come

[DGroves · Accepted solution]

first off this is a older system circa mid 2007 as such intel has no plans to release updated microcode for cpu's of this generation. and system venders no longer provide any support for systems this old.

next, hp has on several ocasions release updated cpu microcode to support newer cpu's  on systems this microde only updates the cpu support in most cases and as such simply adds the new microcode to the existing bios

if at a later date hp then releases a newer bios for that system that fixes/adds enhcancments to the system via the newer bios, if will by default include the previous microde updates released previously

to recap:

there is no need to install the microcode update and then a newer bios update, since the newer bios by default will allready have  the latest microcode

[89u2]

thanks for reply DGroves, due to age of my machine, there's no plan to release new updated microupdate for cpu's

[mdklassen]

Note that HP issued an advisory on 23-JAN-2018, indicating that they are "withdrawing" all the BIOS updates they created for Meltdown/Spectre, due to issues arising on systems that installed the update.  HP indicated that a "better" [my words] update will be released [probably in February, IMHO].

Note that every Windows operating system has vulnerabilities.

Some of those vulnerabilities were patched on Tuesday, January 9, 2018 [2nd Tuesday of the month].

Some of those vulnerabilities will be patched on Shrove Tuesday, February 13, 2018.

Some of those vulnerabilities are still unknown -- patches are not yet available.

So, one may debate about whether the Meltdown/Spectre vulnerability is any different than all the other vulnerabilities.

It's my understanding that the operating system must first be compromised, by some other "rogue" software, before a program running on that compromised system can exploit the Meltdown/Spectre vulnerability.  So, if the computer is compromised, it is already compromised.

[89u2]

oh ok thank you mdklassen