This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy >

Security Advisory - CPU Vulnerabilities 'Meltdown' and 'Spectre'

  • SA No:huawei-sa-20180106-01-cpu
  • Initial Release Date: 2018-01-06
  • Last Release Date: 2019-03-05

Security researchers disclosed two groups of CPU vulnerabilities "Meltdown" and "Spectre". In some circumstances, a local attacker could exploit these vulnerabilities to read memory information belonging to other processes or other operating system kernel. (Vulnerability ID: HWPSIRT-2018-01001, HWPSIRT-2018-01002, HWPSIRT-2018-01003)

This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2017-5715, CVE-2017-5753 and CVE-2017-5754.

Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180106-01-cpu-en

Carrier customers can log into Huawei Support website to obtain information about affected products and solutions: http://support.huawei.com/carrier/docview!docview?nid=NEWS2100007596&path=PBI1-8132379


Product Name

Affected Version

Resolved Product and Version

1288H V5/ 2288H V5

Earlier than V100R005C00SPC110 (BIOS V059) versions

V100R005C00SPC110 (BIOS V059)

2488 V5 

Earlier than V100R005C00SPC301 (BIOS V080) versions

V100R005C00SPC301 (BIOS V080)

2488H V5 

Earlier than V100R005C00SPC101 (BIOS V080) versions

V100R005C00SPC101 (BIOS V080)

5288 V3

Earlier than V100R003C00SPC620 (BIOS V387) versions

V100R003C00SPC620 (BIOS V387)

Access Router:
AR100/ AR100-S/ AR110-S/ AR120/ AR120-S/ AR1220C/ AR1500/ AR151-S2/ AR160 （Exclude AR160F）/ AR160-S （Exclude AR160F-S）/ AR2204-XGE/ AR3600/SRG1300/ SRG1320E

Earlier than V200R009C00SPC500  versions

V200R009C00SPC500

BH622 V2

Earlier than V100R002C00SPC307 (BIOS V518) versions                

V100R002C00SPC307  (BIOS V518)

BH640 V2

Earlier than V100R002C00SPC305 (BIOS V518) versions                

V100R002C00SPC305  (BIOS V518)

CH121

Earlier than V100R001C00SPC305 (BIOS V521) versions

V100R001C00SPC305 (BIOS V521)

CH121 V3/ CH220 V3/ CH222 V3

Earlier than V100R001C00SPC255 (BIOS V387) versions

V100R001C00SPC255 (BIOS V387)

CH121 V5 

Earlier than V100R001C00SPC122 (BIOS V059) versions

V100R001C00SPC122 (BIOS V059)

CH121H V3

Earlier than V100R001C00SPC115 (BIOS V387) versions

V100R001C00SPC115 (BIOS V387)

CH121L V3/ CH140L V3/ CH225 V3

Earlier than V100R001C00SPC155 (BIOS V387) versions

V100R001C00SPC155 (BIOS V387)

CH121L V5 

Earlier than V100R001C00SPC120 (BIOS V059) versions

V100R001C00SPC120 (BIOS V059)

CH140

Earlier than V100R001C00SPC325 (BIOS V521) versions

V100R001C00SPC325 (BIOS V521)

CH140 V3/ CH226 V3

Earlier than V100R001C00SPC175 (BIOS V387) versions

V100R001C00SPC175 (BIOS V387)

CH220

Earlier than V100R001C00SPC305 (BIOS V521) versions

V100R001C00SPC305 (BIOS V521)

CH221

Earlier than V100R001C00SPC305 (BIOS V521) versions

V100R001C00SPC305 (BIOS V521)

CH222

Earlier than V100R001C00SPC305 (BIOS V521) versions

V100R001C00SPC305 (BIOS V521)

CH240

Earlier than V100R001C00SPC305 (BIOS V521) versions

V100R001C00SPC305 (BIOS V521)

CH242 V3

Earlier than V100R001C00SPC325 (BIOS V810 for CH242 V3 DDR4, BIOS V355 for CH242 V3) versions

V100R001C00SPC325 (BIOS V810 for CH242 V3 DDR4, BIOS V355 for CH242 V3)

CH242 V5 

Earlier than V100R001C00SPC111 (BIOS V080) versions

V100R001C00SPC111 (BIOS V080)

DH320 V2

Earlier than V100R001C00SPC109 (BIOS V518) versions                 

V100R001C00SPC109  (BIOS V518)

DH321 V2

Earlier than V100R002C00SPC302 (BIOS V518) versions                

V100R002C00SPC302  (BIOS V518)

DH626 V2

Earlier than V100R002C00SPC200 (BIOS V518) versions                

V100R002C00SPC200  (BIOS V518)

DH628 V2

Earlier than V100R001C00SPC200 (BIOS V518) versions                

V100R001C00SPC200  (BIOS V518)

EulerOS

EulerOS V2.0SP1
EulerOS V2.0SP2

kernel-3.10.0-229.49.1.170
kernel-3.10.0-327.59.59.46.h44

FusionCloud

FusionCloud 6.0.0(KVM)

FusionSphere OpenStack V100R006C10CP0001

FusionCloud

FusionCloud 2.0.6(KVM)

FusionSphere OpenStack V100R006C10SPC511

FusionCloud

FusionCloud 2.0.5(KVM)

FusionSphere OpenStack V100R006C10SPC511

FusionCompute

6.3.0

Upgrade to V100R006C10CP0001

V100R006C00

V100R006C10

V100R006C10CP0001

FusionCube

Earlier than  3.0.1 versions

FusionCube Tool V100R002C02SPC308

FusionSphere

FusionSphere 6.1(XEN)

FusionCompute V100R006C10CP0001

FusionSphere 6.0U1(XEN)

FusionCompute V100R006C00U1CP0001

FusionSphere 5.1（XEN）

FusionCompute V100R005C10CP7003

FusionSphere OpenStack

V100R005C00

Upgrade to V100R006C10SPC511

V100R005C10

V100R006C00

V100R006C10

V100R006C10SPC511

IOT Gateway:
AR500/ AR510/ AR532/ AR550C/ AR550E/ SRG550C

Earlier than V200R009C00SPC500 versions

V200R009C00SPC500

Kunlun 9008/9016/9032

Earlier than V100R001C30SPC103 (BIOS V320) versions

V100R001C30SPC103 (BIOS V320)

MateBook (HZ-W09/ HZ-W19/ HZ-W29)

Earlier than BIOS 1.51 versions

BIOS 1.51

MateBook B200/ MateBook D (PL-W09/ PL-W19/ PL-W29)

Earlier than BIOS 1.20 versions

BIOS 1.20

MateBook D (MRC-W10/ MRC-W50/ MRC-W60)

Earlier than BIOS 1.15 versions

BIOS 1.15

MateBook E (BL-W09/ BL-W19)

Earlier than BIOS 2.02 versions

BIOS 2.02

MateBook X (WT-W09/ WT-W19)

Earlier than BIOS 2.02 versions

BIOS 2.02

NFVI

NFVI 6.1.5(KVM)

FusionSphere OpenStack V100R006C10SPC511

RH1288 V2

Earlier than V100R002C00SPC613(BIOS V518) versions

V100R002C00SPC613 (BIOS V518)

RH1288 V3

Earlier than V100R003C00SPC650 (BIOS V387) versions

V100R003C00SPC650 (BIOS V387)

RH1288A V2

Earlier than V100R002C00SPC707(BIOS V518) versions

V100R002C00SPC707 (BIOS V518)

RH2265 V2

Earlier than V100R002C00SPC509(BIOS V518) versions

V100R002C00SPC509 (BIOS V518)

RH2268 V2

Earlier than V100R002C00SPC607(BIOS V518) versions

V100R002C00SPC607 (BIOS V518)

RH2285 V2

Earlier than V100R002C00SPC509(BIOS V518) versions

V100R002C00SPC509 (BIOS V518)

RH2285H V2

Earlier than V100R002C00SPC509(BIOS V518) versions

V100R002C00SPC509 (BIOS V518)

RH2288 V2

Earlier than V100R002C00SPC607(BIOS V518) versions

V100R002C00SPC607 (BIOS V518)

RH2288 V3

Earlier than V100R003C00SPC646 (BIOS V387) versions

V100R003C00SPC646 (BIOS V387)

RH2288A V2

Earlier than V100R002C00SPC707(BIOS V518) versions

V100R002C00SPC707 (BIOS V518)

RH2288E V2

Earlier than V100R002C00SPC301(BIOS V601) versions

V100R002C00SPC301 (BIOS V601)

RH2288H V2

Earlier than V100R002C00SPC618(BIOS V518) versions

V100R002C00SPC618 (BIOS V518)

RH2288H V3

Earlier than V100R003C00SPC552 (BIOS V387) versions

V100R003C00SPC552 (BIOS V387)

RH2485 V2

Earlier than V100R002C00SPC711 (BIOS V518) versions                

V100R002C00SPC711  (BIOS V518)

RH5885 V2

Earlier than V100R001C02SPC305 (4P:BIOS V037, 8P:BIOS V061) versions

V100R001C02SPC305  (4P:BIOS V037, 8P:BIOS V061)

RH5885 V3

Earlier than V100R003C01SPC126(BIOS V355)V100R003C10SPC120(BIOS V810) versions

V100R003C01SPC126 (BIOS V355)
V100R003C10SPC120 (BIOS V810)

RH5885H V3

Earlier than V100R003C00SPC217 (E7V2:BIOS V355, E7V3:BIOS V657), V100R003C10SPC119 (E7V4:BIOS V810) versions

V100R003C00SPC217 (E7V2:BIOS V355, E7V3:BIOS V657), V100R003C10SPC119 (E7V4:BIOS V810)

RH8100 V3

Earlier than V100R003C00SPC226(E7V2&E7V3: BIOS V697 E7V4:BIOS V810) versions

V100R003C00SPC226 (E7V2&E7V3: BIOS V697 E7V4:BIOS V810)

SMC2.0

V100R003C10

Upgrade to V600R006C10SPC300

V500R002C00

UC Audio Recorder

V100R001C02

Upgrade to CloudUSM V600R006C10SPC300

VP9630

V600R006C10

V600R006C10SPC200

VP9660

V600R006C10

V600R006C10SPC200

XH320 V2

Earlier than V100R001C00SPC205(BIOS V518) versions

V100R001C00SPC205 (BIOS V518)

XH321 V2

Earlier than V100R002C00SPC305(BIOS V518) versions

V100R002C00SPC305 (BIOS V518)

XH321 V3

Earlier than V100R003C00SPC502 (BIOS V387) versions

V100R003C00SPC502 (BIOS V387)
XH321 V5
 Earlier than
V100R005C00SPC501 (BIOS V095) versions
  V100R005C00SPC501 (BIOS V095)

XH620 V3

Earlier than V100R003C00SPC625 (BIOS V387) versions

V100R003C00SPC625 (BIOS V387)

XH621 V2

Earlier than V100R001C00SPC205 (BIOS V518) versions                

V100R001C00SPC205  (BIOS V518)

XH622 V3/ XH628 V3

Earlier than V100R003C00SPC623 (BIOS V387) versions

V100R003C00SPC623 (BIOS V387)

eSpace 8950

V200R003C00

Upgrade to eSpace8950 V200R003C30SPC500

eSpace ECS

V300R001C00

Upgrade to CloudECS V600R006C10SPC200

eSpace UMS

V200R002C00

Upgrade to Unified Messaging System V600R006C10SPC200

eSpace USM

V300R001C00

V300R001C00SPC

iManager NetEco

Earlier than V600R008C30 versions

Upgrade to iManager NetEco 6000-TOOL_Linux_AutoInstall V600R007C00SPC250

iManager NetEco 6000

Earlier than V600R008C00 versions

Upgrade to iManager NetEco 6000-TOOL_Linux_AutoInstall V600R007C00SPC250

Note:  

[1] To fix these vulnerabilities, update OS patches and BIOS firmware, OS patches are provided by the operating system vendors.

[2]About the performance test, please refer to FAQ section as below.

An attacker could exploit these vulnerabilities to read memory information belonging to other processes or other operating system kernel.

The vulnerability classification has been performed by using the CVSSv3 scoring system (https://www.first.org/cvss/specification-document) .

CVE-2017-5715:

Base Score: 8.2 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N)

Temporal Score: 7.6 (E:F/RL:O/RC:C)

CVE-2017-5753 & CVE-2017-5754:

Base Score: 7.1 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)

Temporal Score: 6.6 (E:F/RL:O/RC:C)


1. Prerequisite:

An attacker must be able to run crafted code on an affected device.

2. Attacking procedure:

In some circumstances, a local attacker could exploit these vulnerabilities to read memory information belonging to other processes or other operating system kernel.

None


Customers should contact Huawei TAC (Huawei Technical Assistance Center) to request the upgrades. For TAC contact information, please refer to Huawei worldwide website at http://www.huawei.com/en/psirt/report-vulnerabilities.

These vulnerabilities were publicly disclosed.

2019-03-05 V2.6 UPDATED Updated the affected version and fix version information
2018-11-07 V2.5 UPDATED Updated the affected version and fix version information
2018-04-27 V2.4 UPDATED Updated the affected version and fix version information
2018-04-03 V2.3 UPDATED Updated the affected version and fix version information
2018-03-21 V2.2 UPDATED Updated the affected version and fix version information
2018-03-19 V2.1 UPDATED Updated the affected version and fix version information
2018-03-15 V2.0 UPDATED Updated the affected version and fix version information
2018-03-14 V1.9 UPDATED Updated the affected version and fix version information
2018-03-12 V1.8 UPDATED Updated the Note and FAQ information
2018-03-01 V1.7 UPDATED Updated the affected version and fix version information
2018-02-27 V1.6 UPDATED Updated the summary information
2018-02-26 V1.5 UPDATED Updated the affected version and Note information
2018-02-01 V1.4 UPDATED Updated the recommended version and Note information
2018-01-24 V1.3 UPDATED Updated the affected version and Note information
2018-01-19 V1.2 UPDATED Updated the Note information
2018-01-11 V1.1 UPDATED Updated the affected version
2018-01-06 V1.0 INITIAL

[1]The description of the performance test for 1288H V5/ 2288H V5/ 2488 V5/ 2488H V5/ 5288 V3/ CH121/ CH121 V3/ CH220 V3/ CH222 V3/ CH121 V5/ CH121H V3/ CH121L V3/ CH140L V3/ CH225 V3/ CH121L V5/ CH140/ CH140 V3/ CH226 V3/ CH220/ CH221/ CH222/ CH240/ CH242 V3/ CH242 V5/ Kunlun 9008/9016/9032/ RH1288 V3/ RH2288 V3/ RH2288H V3/ XH321 V3/ XH620 V3/ XH622 V3/ XH628 V3 products.

Intel released the performance test result of two-socket Intel Xeon Platinum 81xx processors on January 18:

https://newsroom.intel.com/news/firmware-updates-and-initial-performance-data-for-data-center-systems/

The performance test results for patches in major OSs are as follows: 
Microsoft: https://cloudblogs.microsoft.com/microsoftsecure/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems 
Red Hat: https://access.redhat.com/articles/3307751 
SUSE: https://www.suse.com/c/meltdown-spectre-performance/

After the Intel microcode patch is installed, the performance impact is closely related to the operating system and running services. Customers are advised to verify and assess the performance based on running services.


Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.

To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.

To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.