Intel Meltdown and Spectre

[M4nti0n]

They actually did in June of 2017. So yes... They did know.

[Keesjand]

The 1 milion dollar Q for me is still: will HP also patch laptops (and printers?) that are older then the 3 years warrenty?

Why are there no HP support reps around in the forum?

[M4nti0n]

It has treysis

[M4nti0n]

@keesjand, that's a question I don't know the answer at. My 840 G1 would get an update they said. That's a laptop from 2015 and has no warranty anymore. So let's hope they tell the truth 😉

[treysis]

@M4nti0n: I highly doubt it. Or why is the ME-vulnerability referencing the wrong CVEs?

[mdklassen]

> why is the ME-vulnerability referencing the wrong CVEs?

What is the URL of the web-page that you are referring to?

[M4nti0n]

The link that updates the bios including ME firmware and Microprocessor firmware for the Dell Latitude E7470.
It tells me:
- Update to the latest CPU microcode to address CVE-2017-5715.
- Updated Intel ME Firmware to address security advisories INTEL-SA-00086 (CVE-2017-5705, CVE-2017-5708, CVE-2017-5711 & CVE-2017-5712) & INTEL-SA-00101(CVE-2017-13077, CVE-2017-13078 & CVE-2017-13080).

And Dell likes to cover stuff up to look different. It really fixes the meltdown stuff. I don't know about the spectre though. 😉

http://www.dell.com/support/home/nl/nl/nlbsdt1/drivers/driversdetails?driverId=ND42N

[M4nti0n]

At least, the BIOS update is here for my 840 G1

HP Notebook System BIOS Update
Type: BIOS
Versie: 01.41 Rev.A
Besturingssystemen: Windows 10 (64-bits)
Uitgiftedatum: 9 jan. 2018
Bestandsnaam: sp84396.exe (13.9 MB)

- Fix the issue where HP Logo lockup when USB devices connected to the 2013 Ultraslim
- Fix the issue where Wireless Keyboards do not get reset in UEFI mode with McAfee Drive Encryption on Windows 10 and Ultralslime dock used when the preboot file system should be handing off to the OS if XHCI is enabled in F10. - Updates the Intel Microcontroller unit (MCU) to version 0x96.
- Provides improved security of UEFI code and variables. HP strongly recommends transitioning promptly to this updated BIOS version which supersedes all previous releases.

NOTE: Due to security changes, after this BIOS update is installed, previous versions cannot be reinstalled.

[mdklassen]

> why is the ME-vulnerability referencing the wrong CVEs?

If you are referring to:  http://www.dell.com/support/home/ca/en/cabsdt1/drivers/driversdetails?driverId=ND42N

it states:

Fixes:
 - Update to the latest CPU microcode to address CVE-2017-5715.
 - Updated Intel ME Firmware to address security advisories INTEL-SA-00086 (CVE-2017-5705, CVE-2017-5708, CVE-2017-5711 & CVE-2017-5712) & INTEL-SA-00101(CVE-2017-13077, CVE-2017-13078 & CVE-2017-13080).

So, this software update addresses CVE-2017-5715 -- which is the "meltdown/spectre" vulnerability,

and also the IME (Intel Management Extension): CVE-2017-5705, CVE-2017-5708, et cetera.

What is "wrong" with those references?

[treysis]

@mdklassen: No, I am not referencing to that link. I am referencing to https://www.intel.com/content/www/us/en/support/articles/000025619/software.html which was posted in the beginning of this thread.

Apparently, the BIOS update you linked does fix both. The Intel-tool, however, just checks for ME-vulnerability, and you can see this because it (the tool) references the wrong CVE. Your provided link - since it fixes Spectre as well - of course also specifies the correct CVE for Spectre!