Security Protection against Processor Vulnerabilities (released by Intel in November 2019)

Published: Dec 27, 2019

Thank you for using NEC Express5800 products

We have been informed of new vulnerabilities of processors supporting speculative and out-of-order executions. The following vulnerabilities may affect our products:

• CVE ID numbers
  CVE-2018-12207, CVE-2019-0123, CVE-2019-0124, CVE-2019-0131, CVE-2019-0139, CVE-2019-0140, CVE-2019-0142,
  CVE-2019-0143, CVE-2019-0144, CVE-2019-0145, CVE-2019-0146, CVE-2019-0147, CVE-2019-0148, CVE-2019-0149,
  CVE-2019-0150, CVE-2019-0151, CVE-2019-0152, CVE-2019-0165, CVE-2019-0166, CVE-2019-0168, CVE-2019-0169,
  CVE-2019-0184, CVE-2019-11086, CVE-2019-11087, CVE-2019-11088, CVE-2019-11090, CVE-2019-11097,
  CVE-2019-11100, CVE-2019-11101, CVE-2019-11102, CVE-2019-11103, CVE-2019-11104, CVE-2019-11105,
  CVE-2019-11106, CVE-2019-11107, CVE-2019-11108, CVE-2019-11109, CVE-2019-11110, CVE-2019-11131,
  CVE-2019-11132, CVE-2019-11135, CVE-2019-11136, CVE-2019-11137, CVE-2019-11139, CVE-2019-11147
  


• Intel advisory numbers
  INTEL-SA-00164, INTEL-SA-00210, INTEL-SA-00220, INTEL-SA-00240, INTEL-SA-00241, INTEL-SA-00255,
  INTEL-SA-00270, INTEL-SA-00271, INTEL-SA-00280
  

Any of our products with these vulnerabilities, if attacked by a malicious program, may lead to a denial of service (DoS) by a remote third party and cause its data to be stolen or falsified.

Please take mitigation measures against the vulnerabilities by checking this page for how to handle them and what our handling status is.

Exploiting any of the following vulnerabilities, an attack may lead to a DoS by a remote third party and cause the data of the affected device to be stolen from its memory or to be falsified:

< Vulnerability information reported in November 2019：INTEL-SA-00164, INTEL-SA-00210, INTEL-SA-00220, INTEL-SA-00240, INTEL-SA-00241, INTEL-SA-00255, INTEL-SA-00270, INTEL-SA-00271, INTEL-SA-00280, INTEL-SA-00313 >

• Press releases about the vulnerabilities from Intel
<https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00164.html>
<https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00210.html>
<https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00220.html>
<https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00240.html>
<https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html>
<https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html>
<https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00270.html>
<https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00271.html>
<https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00280.html>
<https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html>

Regarding all the above vulnerabilities, any of the affected products requires updating its system BIOS and applying patches to its current operating system.

• Updating the system BIOS

  The following lists the affected products as well as when and where their update patches will be released.
  Please download and apply necessary patches.
  < Affected products list and release schedule of module updates >
  

  Affected products list and release schedule of module updates:      

  • Express5800/100 Series
  • Express5800/SIGMABLADE
  • Express5800/FT Server
  • Express5800/Modular Server DX Series
  • Express5800/Scalable HA Server
  - This information will be updated as needed.
  - Precaution for updating the system BIOS
  Before obtaining and applying the latest BIOS version, be sure to check the current BIOS version of your product.
  
  
  

• Applying security updates to the operating system

  Please see relevant information released by the operating system vendors.
  Note that this application may degrade the performance depending on the usage or load of your product.

  [Windows]
  Microsoft Corporation has the following solution site:
  • Guidance for protecting against Intel® Processor Machine Check Error vulnerability (CVE-2018-12207)
    <https://support.microsoft.com/en-us/help/4530989/guidance-for-protecting-against-intel-processor-machine-check-error>
  
  
  [Linux(RHEL)]
  Red Hat has the following solution site:
  • Machine Check Error on Page Size Change - CVE-2018-12207 <https://access.redhat.com/security/vulnerabilities/ifu-page-mce>
  
  
  [VMware]
  VMware has the following solution site:
  • VMware Security Advisories（VMSA-2019-0020）
    <https://www.vmware.com/security/advisories/VMSA-2019-0020.html>