IBM i PTF Guide, Volume 20, Number 4, The Spectre Of Meltdowns
January 31, 2018 Doug Bidwell
As we have pointed out, the Spectre and Meltdown speculative execution security vulnerabilities have been classified by IBM’s Product Security Incident Response Team (PSIRT) as having a “High Severity” level.
This week’s update is somewhat chilling. IBM announced additional PTFs to be fully protected, meaning you have to do both, and also do the firmware fix.
But wait, there’s more. . . . The HIPER and Security groups for each release were re-released over the weekend, but only the first of each set below is included in the Security group. So, if you order and download the latest HIPERs and Security groups, you only get one of the two required fixes. Check it out:
For those of us who are waiting for all the fixes to show in groups before installing any of them – it takes an IPL to get any of them installed, so why not wait for all of them and do one IPL? – so it looks like we wait at least one more cycle. We are keeping a watchful eye out for any reports of Spectre/Meltdown victims, but have not heard anything as yet. Of course, if there are pressing business or security concerns, put them on now!
For OS managed firmware systems (repeated):
- The Power8 firmware fix for SC860_138_056/FW860.42 is MH01739.
- The Power7 and Power7+ firmware fix for AL770_120_032/FW770.91 is MH01740.
Both the appropriate OS PTF and the firmware fix are required to completely mitigate the risk from the vulnerability. The best resource for firmware updates is the following link: http://www-01.ibm.com/support/docview.wss?uid=isg3T1026811. This information is not complete as yet, we expect more on earlier Power models in the following weeks.
There are additional HIPERs and security fixes in their appropriate groups that are not to be ignored.
One last thing: We have added several links to the IBM i PTF Guide, with the most significant being links to the APAR Database for each release – check them out!
Below is the archive of the IBM i PTF Guide to help you work through the PTFs in chronological order: