Customer Release Notes - HPE ProLiant DL360 Gen10 System ROM - U32 1.42_06-20-2018


Important Notes:

This revision of the System ROM includes the latest revision of the Intel microcode which, in combination with operating system updates, provides mitigation for the Speculative Store Bypass (also known as Variant 4) security vulnerability.  A Medium level CVE has been assigned to this issue with ID CVE-2018-3639.  Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.  This security vulnerability is not unique to HPE servers and impacts any systems utilizing impacted processors.

This revision of the System ROM includes the latest revision of the Intel microcode which provides mitigation for the Rogue Register Read (also known as Variant 3a) security vulnerability.  A Medium level CVE has been assigned to this issue with ID CVE-2018-3640.  Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis.  This security vulnerability is not unique to HPE servers and impacts any systems utilizing impacted processors.


Deliverable Name:

HPE ProLiant DL360 Gen10 System ROM - U32


Release Version:

1.42_06-20-2018


Last Recommended or Critical Revision:

1.42_06-20-2018


Previous Revision:

1.40_06-15-2018


Upgrade Requirement:

Critical

HPE requires users update to this version immediately

Firmware Dependencies:

None


Enhancements/New Features:

None


Problems Fixed:

This revision of the System ROM includes the latest revision of the Intel microcode which, in combination with operating system updates, provides mitigation for the Speculative Store Bypass (also known as Variant 4) security vulnerability.  A Medium level CVE has been assigned to this issue with ID CVE-2018-3639.  Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.  This security vulnerability is not unique to HPE servers and impacts any systems utilizing impacted processors.

This revision of the System ROM includes the latest revision of the Intel microcode which provides mitigation for the Rogue Register Read (also known as Variant 3a) security vulnerability.  A Medium level CVE has been assigned to this issue with ID CVE-2018-3640.  Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis.  This security vulnerability is not unique to HPE servers and impacts any systems utilizing impacted processors.

This firmware version includes additional fixes (since version 1.40) for an issue where systems may experience a 389-Unexpected Shutdown and Restart, logged in the iLO Integrated Management Log (IML). This issue is not unique to HPE servers.

Addressed an issue where systems may log an erroneous Bank 4 Machine Check to the iLO Integrated Management Log (IML) on a system reset event. In most cases, this error can safely be ignored. This issue is not unique to HPE servers.

Addressed an issue where systems configured with NVDIMM-N Memory may experience a loss of persistent data during a system crash event that would cause a fatal processor error condition (IERR). This issue is not unique to HPE servers.


Known Issues:

None

Copyright 2018 Hewlett Packard Enterprise. All rights reserved.