Protecting your 9040-MR9, 9080-M9S servers against “Spectre” and “Meltdown”
Protect your 9040-MR9, 9080-M9S servers from “Spectre” and “Meltdown” vulnerabilities.
Introduction
Four security vulnerabilities that allow unauthorized users to bypass the hardware barrier between applications and kernel memory were made public earlier this year. These vulnerabilities make use of speculative execution to perform side-channel information disclosure attacks.
The first three vulnerabilities, CVE-2017-5753 and CVE-2017- 5715 (collectively known as Spectre) and CVE-2018-3639 (known as Speculative Store Bypass) allow user or kernel-level code to infer data from unauthorized memory.
The fourth vulnerability, CVE-2017-5754 (known as Meltdown), allows user-level code to infer the contents of kernel memory.
The vulnerabilities are all variants of the same class of attacks but differ in the way that speculative execution could be exploited.
While these vulnerabilities do not allow an external unauthorized party to gain access to a machine, they could allow a party with access to a system to access unauthorized data.
Since the customer-specific operating environments, including system (including use of hypervisors) application, and operating systems are varied, POWER9™ systems (9040-MR9, 9080-M9S) provide the option for customers to control speculative execution at a system level, to meet their individual security standards.
- Speculative execution controls to mitigate user-to-kernel and user-to-user side-channel attacks
- Speculative execution fully enabled
Speculative execution controls to mitigate user-to-kernel and user-to-user side-channel attacks
This mode is designed for systems that need to mitigate exposures of the hypervisor, operating systems, and user application data to untrusted code. For the 9040-MR9, 9080-M9S models this mode is set as the default.
Speculative execution fully enabled
Accessing speculative execution control options
Speculative execution control options can be accessed using the Advanced Systems Management Interface (ASMI) menu under System Configuration > Speculative Execution Control. This setting can be changed when the system is in powered off state.