Alert.png The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @ egi.eu.

Difference between revisions of "SVG:Meltdown and Spectre Vulnerabilities"

From EGIWiki
Jump to navigation Jump to search
(34 intermediate revisions by 4 users not shown)
Line 1: Line 1:
{{svg-header}}  
{{svg-header}}  
 
== Purpose of this page  ==


More information is likely to be added in the coming days. This is an initial version.
To provide more detailed information about the Meltdown and Spectre vulnerabilities, to complement the advisory, [[SVG:Advisory-SVG-CVE-2017-5753]].


== Purpose of this page  ==
This was compiled in January and early February 2018


To provide useful links and other information concerning the Meltdown and Spectre vulnerabilities, which we consider relevant to the EGI infrastructure.
Information including more recent [[SVG:Speculative Execution Vulnerabilities | SVG Speculative execution vulnerabilities ]]


== What are they?  ==
== What are they?  ==


These are vulnerabilities in the design of the chip hardware, and cannot be fully resolved by patching operating systems. However patches are available which mitigate these problems.  
These are vulnerabilities in the design of the chip hardware, and cannot be fully resolved by patching operating systems. However patches are available which mitigate these problems.
* Meltdown (CVE-2017-5754) affects most Intel chips.
* Spectre (CVE-2017-5753 and CVE-2017-5715) affects a wide range of chips.


Meltdown affects most Intel chips, and has CVE-2017-5754
For more details, see [https://meltdownattack.com/ https://meltdownattack.com/ ], [https://spectreattack.com/ https://spectreattack.com/] and [https://googleprojectzero.blogspot.dk/2018/01/reading-privileged-memory-with-side.html https://googleprojectzero.blogspot.dk/2018/01/reading-privileged-memory-with-side.html]


Spectre affects a wide range of chips, CVE-2017-5753 and CVE-2017-5715.
== How to mitigate these vulnerabilities ==


Here you will find more information  [http://www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability/ http://www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability/]
Each CVE can be mitigated via different ways:
* Meltdown (CVE-2017-5754) can be mitigated via [https://en.wikipedia.org/wiki/Kernel_page-table_isolation Kernel Page Table Isolation], which is enabled by default in latest linux kernels
* Spectre Variant 1 (CVE-2017-5753) has to be mitigated in each software which can be vulnerable. The latest linux kernel contains fixes to protect itself (does not protect other software).
* Spectre Variant 2 (CVE-2017-5715) can be (at least partially) mitigated via at least two different approach:
** Using new Intel-specific MSR, added via a microcode update, to control indirect branch restricted speculation (IBRS): Both a kernel and a microcode update are required. In addition, in case of virtualization, an update of the virtualization software (e.g. qemu & virt) is required to expose the new MSR to the VM.
** Using "retpoline", a new software construct that can mitigate, on most CPUs, the vulnerability


[https://meltdownattack.com/ https://meltdownattack.com/ ], [https://spectreattack.com/ https://spectreattack.com/] and [https://googleprojectzero.blogspot.dk/2018/01/reading-privileged-memory-with-side.html https://googleprojectzero.blogspot.dk/2018/01/reading-privileged-memory-with-side.html]
=== RedHat ===


== CERN information  ==
As of Feb 2nd 2018, RedHat has [https://access.redhat.com/security/vulnerabilities/speculativeexecution offered new kernel updates that can mitigate Meltdown (CVE-2017-5754), Spectre Variant 1 (CVE-2017-5753) and Spectre Variant 2 (CVE-2017-5715)].


CERN has compiled information which is useful for many EGI sites
However, due to instability issues, it has [https://access.redhat.com/errata/RHSA-2018:0093 removed the microcode updates required for Spectre Variant 2 (CVE-2017-5715)]. Until Intel releases stable microcode or RedHat switches to 'retpoline', no mitigation for Spectre Variant 2 (CVE-2017-5715) is safely usable.


[https://security.web.cern.ch/security/advisories/spectre-meltdown/spectre-meltdown.shtml https://security.web.cern.ch/security/advisories/spectre-meltdown/spectre-meltdown.shtml]  
It is currently possible to mitigate Meltdown (CVE-2017-5754) and Spectre Variant 1 (CVE-2017-5753) by:
* On RHEL7: Updating the kernel to 3.10.0-693.11.6.el7, see [https://access.redhat.com/errata/RHSA-2018:0007 RHSA-2018:0007]
* On RHEL6: Updating the kernel to 2.6.32-696.18.7.el6, see [https://access.redhat.com/errata/RHSA-2018:0008 RHSA-2018:0008]


== Intel Information  ==
=== Centos ===


Product patches
Centos is following RedHat (see above).


[https://downloadcenter.intel.com/download/27431/Linux-Processor-Microcode-Data-File https://downloadcenter.intel.com/download/27431/Linux-Processor-Microcode-Data-File]  
It is currently possible to mitigate Meltdown (CVE-2017-5754) and Spectre Variant 1 (CVE-2017-5753) by:
* On Centos 7: Updating the kernel to 3.10.0-693.11.6.el7, see [https://lists.centos.org/pipermail/centos-announce/2018-January/022696.html CESA-2018:0007]
* On Centos 6: Updating the kernel to 2.6.32-696.18.7.el6, see [https://lists.centos.org/pipermail/centos-announce/2018-January/022701.html CESA-2018:0008]


== RedHat Information  ==
=== Scientific Linux ===


RedHat description:
Scientific Linux is following RedHat (see above).


[https://access.redhat.com/security/vulnerabilities/speculativeexecution https://access.redhat.com/security/vulnerabilities/speculativeexecution]  
It is currently possible to mitigate Meltdown (CVE-2017-5754) and Spectre Variant 1 (CVE-2017-5753) by:
* On SL7: Updating the kernel to 3.10.0-693.11.6.el7, see [https://www.scientificlinux.org/category/sl-errata/slsa-20180007-1/ SLSA-2018:0007-1]
* On SL6: Updating the kernel to 2.6.32-696.18.7.el6, see [https://www.scientificlinux.org/category/sl-errata/slsa-20180008-1/ SLSA-2018:0008-1]


[https://access.redhat.com/articles/3307751 https://access.redhat.com/articles/3307751]
Additional details as well as information on other systems and platforms can be found in the next section.


<br>
== More Information ==


RedHat CVE info: [https://access.redhat.com/security/cve/CVE-2017-5754]
=== Relevant Advisories ===
==== CERN ====


[https://access.redhat.com/security/cve/CVE-2017-5754 https://access.redhat.com/security/cve/CVE-2017-5754]
CERN has compiled information which is useful for many EGI sites:


[https://access.redhat.com/security/cve/CVE-2017-5753 https://access.redhat.com/security/cve/CVE-2017-5753]  
[https://security.web.cern.ch/security/advisories/spectre-meltdown/spectre-meltdown.shtml https://security.web.cern.ch/security/advisories/spectre-meltdown/spectre-meltdown.shtml]


[https://access.redhat.com/security/cve/CVE-2017-5715 https://access.redhat.com/security/cve/CVE-2017-5715]
==== Intel ====


<br>
Intel has initially, on January 8th, [https://downloadcenter.intel.com/download/27431/Linux-Processor-Microcode-Data-File released new microcodes] to complement the IBRS kernel patchset. However, these new microcodes are in fact '''unstable''' and Intel has since then recommended to stop deploying them.


RHEL6:  
Intel latest recommendation can be found in their advisory, [https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&languageid=en-fr INTEL-SA-00088]


kernel-2.6.32-696.18.7.el6: [https://access.redhat.com/errata/RHSA-2018:0008 https://access.redhat.com/errata/RHSA-2018:0008]  
More updates and information:
* [https://newsroom.intel.com/news/intel-responds-to-security-research-findings/ Jan 3rd: Initial response]
* [https://newsroom.intel.com/news-releases/intel-issues-updates-protect-systems-security-exploits/ Jan 4th]
* [https://newsroom.intel.com/news/intel-offers-security-issue-update/ Jan 9th: Microcode released]
* [https://newsroom.intel.com/editorials/intel-security-issue-update-initial-performance-data-results-client-systems/ Jan 10th: performance impact analysis]
* [https://newsroom.intel.com/news/intel-security-issue-update-addressing-reboot-issues/ Jan 11th: Microcode unstability reported]
* [https://newsroom.intel.com/news/firmware-updates-and-initial-performance-data-for-data-center-systems/ Jan 17th]
* [https://newsroom.intel.com/news/root-cause-of-reboot-issue-identified-updated-guidance-for-customers-and-partners/ Jan 22th: Instabilities causes found for 2 Intel series]


microcode_ctl-1.17-25.2.el6_9: [https://access.redhat.com/errata/RHSA-2018:0013 https://access.redhat.com/errata/RHSA-2018:0013]
=== Linux Distributions ===
==== RedHat ====


'''Important!'''  
'''Important! [as of 17th January]'''


There appears to be a bug with the microcode_ctl update for Intel model 79 processors (Intel(R) Xeon(R) CPU E5-2637 v4 @ 3.50GHz, Intel(R) Xeon(R) CPU E5-2643 v4 @ 3.40GHz, Intel(R) Xeon(R) CPU E5-2667 v4 @ 3.20GHz and Intel(R) Xeon(R) CPU E5-2667 v4 @ 3.50GHz). The system fails to boot due to udev rules. There is no solution to the problem but to downgrade the microcode_ctl package. For more information, see: https://bugzilla.redhat.com/show_bug.cgi?id=1532283
RedHat has issued new microcode_ctl packages to rollback the latest updates, see [https://access.redhat.com/errata/RHSA-2018:0093 RHSA-2018:0093].


https://access.redhat.com/solutions/3314661
<br>


<br> RHEL7:  
RedHat description:  
 
* [https://access.redhat.com/security/vulnerabilities/speculativeexecution https://access.redhat.com/security/vulnerabilities/speculativeexecution]
kernel-3.10.0-693.11.6.el7: [https://access.redhat.com/errata/RHSA-2018:0007 https://access.redhat.com/errata/RHSA-2018:0007]
* [https://access.redhat.com/articles/3307751 https://access.redhat.com/articles/3307751 (subscription required)]
 
* [https://access.redhat.com/solutions/3315431 https://access.redhat.com/solutions/3315431 (subscription required)]
microcode_ctl-2.1-22.2.el7: [https://access.redhat.com/errata/RHSA-2018:0012 https://access.redhat.com/errata/RHSA-2018:0012]  
 
linux-firmware-20170606-57.gitc990aae.el7_4: [https://access.redhat.com/errata/RHSA-2018:0014 https://access.redhat.com/errata/RHSA-2018:0014]  
 
<br> qemu-kvm:
 
RHEL6:
 
qemu-kvm: [https://access.redhat.com/errata/RHSA-2018:0024 https://access.redhat.com/errata/RHSA-2018:0024]  


libvirt: [https://access.redhat.com/errata/RHSA-2018:0030 https://access.redhat.com/errata/RHSA-2018:0030]  
RedHat CVE info:
* [https://access.redhat.com/security/cve/CVE-2017-5754 CVE-2017-5754]
* [https://access.redhat.com/security/cve/CVE-2017-5753 CVE-2017-5753]
* [https://access.redhat.com/security/cve/CVE-2017-5715 CVE-2017-5715]


RHEL7:
==== CentOS ====


qemu-kvm: [https://access.redhat.com/errata/RHSA-2018:0023 https://access.redhat.com/errata/RHSA-2018:0023]  
'''Important! [as of 17th January]'''


libvirt: [https://access.redhat.com/errata/RHSA-2018:0029 https://access.redhat.com/errata/RHSA-2018:0029]
Centos seems to be following Redhat in the revert of the microcode_ctl package, see [https://git.centos.org/blob/rpms!microcode_ctl.git/c7/SOURCES!disclaimer the disclaimer in the sources of the last package]


== CentOS Information  ==
<br>


CentOS 7:
CentOS 7:
Line 105: Line 123:
[https://lists.centos.org/pipermail/centos-announce/2018-January/date.html  https://lists.centos.org/pipermail/centos-announce/2018-January/date.html]
[https://lists.centos.org/pipermail/centos-announce/2018-January/date.html  https://lists.centos.org/pipermail/centos-announce/2018-January/date.html]


== Some RedHat Linux related issues found ==
==== Scientific Linux ====
 
'''Important! [as of 18th January]'''
 
Scientific Linux is following RedHat in the revert of the microcode_ctl package, see [https://www.scientificlinux.org/category/sl-errata/slsa-20180093-1/ https://www.scientificlinux.org/category/sl-errata/slsa-20180093-1/]
 
<br>


A serious bug in the microcode updates for some Intel CPUs (model 79) as distributed by Redhat (at least for RHEL 6 and derivatives) was found by one site and reported to us.
* SL6: [https://www.scientificlinux.org/category/sl-errata/slsa-20180008-1/ https://www.scientificlinux.org/category/sl-errata/slsa-20180008-1/]
This update rendered systems unbootable.
* SL7: [https://www.scientificlinux.org/category/sl-errata/slsa-20180007-1/ https://www.scientificlinux.org/category/sl-errata/slsa-20180007-1/]


[https://bugzilla.redhat.com/show_bug.cgi?id=1532283 https://bugzilla.redhat.com/show_bug.cgi?id=1532283]
<br>


[https://access.redhat.com/solutions/3314661 https://access.redhat.com/solutions/3314661
* SL6:
** qemu-kvm: [http://scientificlinux.org/category/sl-errata/slsa-20180024-1/ http://scientificlinux.org/category/sl-errata/slsa-20180024-1/]
** libvirt: [http://scientificlinux.org/category/sl-errata/slsa-20180030-1/ http://scientificlinux.org/category/sl-errata/slsa-20180030-1/]
* SL7:
** qemu-kvm: [http://scientificlinux.org/category/sl-errata/slsa-20180023-1/ http://scientificlinux.org/category/sl-errata/slsa-20180023-1/]
** libvirt: [http://scientificlinux.org/category/sl-errata/slsa-20180029-1/ http://scientificlinux.org/category/sl-errata/slsa-20180029-1/]


== Scientific Linux ==
==== Ubuntu ====


SL6:  
[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown]


[https://www.scientificlinux.org/category/sl-errata/slsa-20180008-1/ https://www.scientificlinux.org/category/sl-errata/slsa-20180008-1/]
==== Debian ====


SL7:  
[https://security-tracker.debian.org/tracker/CVE-2017-5715 CVE-2017-5715]
[https://security-tracker.debian.org/tracker/CVE-2017-5753 CVE-2017-5753]
[https://security-tracker.debian.org/tracker/CVE-2017-5754 CVE-2017-5754]


[https://www.scientificlinux.org/category/sl-errata/slsa-20180007-1/ https://www.scientificlinux.org/category/sl-errata/slsa-20180007-1/]
=== System Vendors ===
==== Supermicro ====


<br>
[https://www.supermicro.com/support/security_Intel-SA-00088.cfm https://www.supermicro.com/support/security_Intel-SA-00088.cfm]
 
==== Dell ====
 
'''Important! [as of 23rd January]'''
 
Dell is advising that all customers and partners should not deploy the BIOS update for the Spectre vulnerability at this time due to Intel’s advisory acknowledging reboot issues and unpredictable system behaviour.
 
[http://www.dell.com/support/contents/uk/en/ukbsdt1/article/product-support/self-support-knowledgebase/software-and-downloads/support-for-meltdown-and-spectre http://www.dell.com/support/contents/uk/en/ukbsdt1/article/product-support/self-support-knowledgebase/software-and-downloads/support-for-meltdown-and-spectre]
 
 
[https://www.dell.com/support/article/uk/en/ukbsdt1/sln308588/microprocessor-side-channel-vulnerabilities-cve-2017-5715-cve-2017-5753-cve-2017-5754-impact-on-dell-emc-products-dell-enterprise-servers-storage-and-networking-?lang=en https://www.dell.com/support/article/uk/en/ukbsdt1/sln308588/microprocessor-side-channel-vulnerabilities-cve-2017-5715-cve-2017-5753-cve-2017-5754-impact-on-dell-emc-products-dell-enterprise-servers-storage-and-networking-?lang=en]
 
Note this is changing rather frequently
 
==== HPE ====


qemu-kvn:
[as of January 23]


SL6:
HPE has updated their advisory to note that "Marked impacted products with TBD for System ROM updates per Intel's guidance on microcode issues" - so following suit with DELL.


qemu-kvm: [http://scientificlinux.org/category/sl-errata/slsa-20180024-1/ http://scientificlinux.org/category/sl-errata/slsa-20180024-1/]  
[https://support.hpe.com/hpsc/doc/public/display?sp4ts.oid=null&docLocale=en_US&docId=emr_na-hpesbhf03805en_us https://support.hpe.com/hpsc/doc/public/display?sp4ts.oid=null&docLocale=en_US&docId=emr_na-hpesbhf03805en_us]


libvirt: [http://scientificlinux.org/category/sl-errata/slsa-20180030-1/ http://scientificlinux.org/category/sl-errata/slsa-20180030-1/]
==== Lenovo ====


SL7:
[as of January 23]


qemu-kvm: [http://scientificlinux.org/category/sl-errata/slsa-20180023-1/ http://scientificlinux.org/category/sl-errata/slsa-20180023-1/]
Lenovo security advisory


libvirt: [http://scientificlinux.org/category/sl-errata/slsa-20180029-1/ http://scientificlinux.org/category/sl-errata/slsa-20180029-1/]


== Ubuntu  ==
=== Hypervisors ===


[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown]  
[https://support.lenovo.com/gb/en/solutions/len-18282 https://support.lenovo.com/gb/en/solutions/len-18282]
==== Xen  ====


== Xen  ==


* [https://xenbits.xen.org/xsa/advisory-254.html https://xenbits.xen.org/xsa/advisory-254.html]
* [https://xenbits.xen.org/xsa/advisory-254.html https://xenbits.xen.org/xsa/advisory-254.html]
Line 151: Line 197:
* [https://wiki.xenproject.org/wiki/Respond_to_Meltdown_and_Spectre https://wiki.xenproject.org/wiki/Respond_to_Meltdown_and_Spectre]
* [https://wiki.xenproject.org/wiki/Respond_to_Meltdown_and_Spectre https://wiki.xenproject.org/wiki/Respond_to_Meltdown_and_Spectre]


== Other Cloud related ==
==== QEMU-KVM ====


The Kernel update of the hypervisor appears to be enough to ensure the isolation of the VMs.
In order to protect hypervisors from malicious VMs, the kernel, microcode and QEMU must be updated:


[https://www.qemu.org/2018/01/04/spectre/ https://www.qemu.org/2018/01/04/spectre/]
[https://www.qemu.org/2018/01/04/spectre/ https://www.qemu.org/2018/01/04/spectre/]

Revision as of 14:27, 7 September 2018

Main page Software Security Checklist Issue Handling Advisories Notes On Risk Advisory Template More

Meltdown and Spectre Vulnerabilities


Purpose of this page

To provide more detailed information about the Meltdown and Spectre vulnerabilities, to complement the advisory, SVG:Advisory-SVG-CVE-2017-5753.

This was compiled in January and early February 2018

Information including more recent SVG Speculative execution vulnerabilities

What are they?

These are vulnerabilities in the design of the chip hardware, and cannot be fully resolved by patching operating systems. However patches are available which mitigate these problems.

  • Meltdown (CVE-2017-5754) affects most Intel chips.
  • Spectre (CVE-2017-5753 and CVE-2017-5715) affects a wide range of chips.

For more details, see https://meltdownattack.com/ , https://spectreattack.com/ and https://googleprojectzero.blogspot.dk/2018/01/reading-privileged-memory-with-side.html

How to mitigate these vulnerabilities

Each CVE can be mitigated via different ways:

  • Meltdown (CVE-2017-5754) can be mitigated via Kernel Page Table Isolation, which is enabled by default in latest linux kernels
  • Spectre Variant 1 (CVE-2017-5753) has to be mitigated in each software which can be vulnerable. The latest linux kernel contains fixes to protect itself (does not protect other software).
  • Spectre Variant 2 (CVE-2017-5715) can be (at least partially) mitigated via at least two different approach:
    • Using new Intel-specific MSR, added via a microcode update, to control indirect branch restricted speculation (IBRS): Both a kernel and a microcode update are required. In addition, in case of virtualization, an update of the virtualization software (e.g. qemu & virt) is required to expose the new MSR to the VM.
    • Using "retpoline", a new software construct that can mitigate, on most CPUs, the vulnerability

RedHat

As of Feb 2nd 2018, RedHat has offered new kernel updates that can mitigate Meltdown (CVE-2017-5754), Spectre Variant 1 (CVE-2017-5753) and Spectre Variant 2 (CVE-2017-5715).

However, due to instability issues, it has removed the microcode updates required for Spectre Variant 2 (CVE-2017-5715). Until Intel releases stable microcode or RedHat switches to 'retpoline', no mitigation for Spectre Variant 2 (CVE-2017-5715) is safely usable.

It is currently possible to mitigate Meltdown (CVE-2017-5754) and Spectre Variant 1 (CVE-2017-5753) by:

  • On RHEL7: Updating the kernel to 3.10.0-693.11.6.el7, see RHSA-2018:0007
  • On RHEL6: Updating the kernel to 2.6.32-696.18.7.el6, see RHSA-2018:0008

Centos

Centos is following RedHat (see above).

It is currently possible to mitigate Meltdown (CVE-2017-5754) and Spectre Variant 1 (CVE-2017-5753) by:

  • On Centos 7: Updating the kernel to 3.10.0-693.11.6.el7, see CESA-2018:0007
  • On Centos 6: Updating the kernel to 2.6.32-696.18.7.el6, see CESA-2018:0008

Scientific Linux

Scientific Linux is following RedHat (see above).

It is currently possible to mitigate Meltdown (CVE-2017-5754) and Spectre Variant 1 (CVE-2017-5753) by:

Additional details as well as information on other systems and platforms can be found in the next section.

More Information

Relevant Advisories

CERN

CERN has compiled information which is useful for many EGI sites:

https://security.web.cern.ch/security/advisories/spectre-meltdown/spectre-meltdown.shtml

Intel

Intel has initially, on January 8th, released new microcodes to complement the IBRS kernel patchset. However, these new microcodes are in fact unstable and Intel has since then recommended to stop deploying them.

Intel latest recommendation can be found in their advisory, INTEL-SA-00088

More updates and information:

Linux Distributions

RedHat

Important! [as of 17th January]

RedHat has issued new microcode_ctl packages to rollback the latest updates, see RHSA-2018:0093.


RedHat description:

RedHat CVE info:

CentOS

Important! [as of 17th January]

Centos seems to be following Redhat in the revert of the microcode_ctl package, see the disclaimer in the sources of the last package


CentOS 7:

CentOS 6:

See further in the centos-announce Security mails for January https://lists.centos.org/pipermail/centos-announce/2018-January/date.html

Scientific Linux

Important! [as of 18th January]

Scientific Linux is following RedHat in the revert of the microcode_ctl package, see https://www.scientificlinux.org/category/sl-errata/slsa-20180093-1/



Ubuntu

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown

Debian

CVE-2017-5715 CVE-2017-5753 CVE-2017-5754

System Vendors

Supermicro

https://www.supermicro.com/support/security_Intel-SA-00088.cfm

Dell

Important! [as of 23rd January]

Dell is advising that all customers and partners should not deploy the BIOS update for the Spectre vulnerability at this time due to Intel’s advisory acknowledging reboot issues and unpredictable system behaviour.

http://www.dell.com/support/contents/uk/en/ukbsdt1/article/product-support/self-support-knowledgebase/software-and-downloads/support-for-meltdown-and-spectre


https://www.dell.com/support/article/uk/en/ukbsdt1/sln308588/microprocessor-side-channel-vulnerabilities-cve-2017-5715-cve-2017-5753-cve-2017-5754-impact-on-dell-emc-products-dell-enterprise-servers-storage-and-networking-?lang=en

Note this is changing rather frequently

HPE

[as of January 23]

HPE has updated their advisory to note that "Marked impacted products with TBD for System ROM updates per Intel's guidance on microcode issues" - so following suit with DELL.

https://support.hpe.com/hpsc/doc/public/display?sp4ts.oid=null&docLocale=en_US&docId=emr_na-hpesbhf03805en_us

Lenovo

[as of January 23]

Lenovo security advisory


Hypervisors

https://support.lenovo.com/gb/en/solutions/len-18282

Xen

QEMU-KVM

In order to protect hypervisors from malicious VMs, the kernel, microcode and QEMU must be updated:

https://www.qemu.org/2018/01/04/spectre/