Summary

Many modern processors are susceptible to a group of vulnerabilities which are referred to as Meltdown and Spectre. These vulnerabilities allow unprivileged attackers to abuse CPU data cache timing to leak information out of speculated execution, potentially leading to the arbitrary read of virtual memory across local security boundaries via targeted attacks. This advisory will be updated as additional information becomes available.

Impact

Successful exploitation of these vulnerabilities allows unprivileged attackers to abuse CPU data cache timing to leak information out of speculated execution, potentially leading to the arbitrary read of virtual memory across local security boundaries via targeted attacks. These attacks require the ability to run malicious code directly on the target system.

ONTAP:
Unlike a general-purpose operating system, ONTAP does not provide mechanisms for non-administrative users to run third-party code. Due to this behavior, ONTAP is not affected by either the Spectre or Meltdown attacks. The same is true of all ONTAP variants including both ONTAP running on FAS/AFF hardware as well as virtualized ONTAP products such as ONTAP Select and ONTAP Cloud.

While ONTAP Select and ONTAP Cloud are not directly affected by these attacks, these attacks may be possible against the utilized hypervisor platform. NetApp recommends working with your hypervisor and cloud platform vendors to ensure that your NetApp product is running on a secure and patched platform.

StorageGRID:
StorageGRID and StorageGRID Webscale do not provide mechanisms for running unprivileged third-party code and are not directly affected. For virtualized deployments, NetApp recommends working with your hypervisor and cloud platform vendors to ensure that your NetApp product is running on a secure and patched platform. For Docker-based deployments, NetApp recommends working with your operating system and hardware vendors to ensure that your NetApp product is running on a secure and patched platform.

NetApp HCI Storage Nodes:
Unlike a general-purpose operating system, Element OS is a closed system that does not provide mechanisms for running third-party code. Due to this behavior, Element OS running on SolidFire or NetApp HCI Storage nodes is not affected by either the Spectre or Meltdown attacks as they depend on the ability to run malicious code directly on the target system.

SANtricity:
Unlike a general-purpose operating system, SANtricity does not provide mechanisms for running third-party code. Due to this behavior, SANtricity is not affected by either the Spectre or Meltdown attacks as they depend on the ability to run malicious code directly on the target system.

OnCommand Unified Manager for VMware vSphere:
OnCommand Unified Manager for VMware vSphere packages Unified Manager into a VMware hypervisor environment and does not provide mechanisms for non-administrative users to run third-party code on the hypervisor. Due to this behavior, OnCommand Unified Manager for VMware vSphere is not affected by either the Spectre or Meltdown attacks.

While OnCommand Unified Manager for VMware vSphere is not directly affected by these attacks, these attacks may be possible against the utilized hypervisor platform. NetApp recommends working with your hypervisor and cloud platform vendors to ensure that your NetApp product is running on a secure and patched platform.

Brocade Advisory:
http://www.brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2018-522.htm

FAS/AFF System Firmware (BIOS):
FAS/AFF BIOS firmware does not provide a mechanism to run arbitrary code and thus is not susceptible to either the Spectre or Meltdown attacks.

NetApp HCI Compute Node (Bootstrap OS):
NetApp HCI Compute Node is tracked as affected with remediation by customer installation of ESXi patches and microcode updates from VMware detailed in KB 52245.

NetApp SolidFire & HCI Management Node:
The NetApp SolidFire Element OS Management Node provides console access for end users and therefore it is tracked as affected. The underlying hypervisor infrastructure should be patched by customer installation of ESXi patches and microcode updates. Customers running whitebox server should consult the manufacturer for microcode availability.

Vulnerability Scoring Details

Exploitation and Public Announcements

NetApp is aware of public discussion of this vulnerability.

References

• https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
• https://meltdownattack.com/
• https://spectreattack.com/

Affected Products

• NetApp HCI Compute Node (Bootstrap OS)
• NetApp SolidFire & HCI Management Node

Products Not Affected

• 7-Mode Transition Tool
• ATTO FibreBridge
• Active IQ Unified Manager (formerly OnCommand Unified Manager) for Linux 7.3 and above
• Active IQ Unified Manager (formerly OnCommand Unified Manager) for VMware vSphere 9.5 and above
• Active IQ Unified Manager (formerly OnCommand Unified Manager) for Windows 7.3 and above
• Brocade Fabric Operating System Firmware
• Brocade Network Advisor Software
• Cluster Network Switch (NetApp CN1610)
• Clustered Data ONTAP
• Clustered Data ONTAP Antivirus Connector
• Data ONTAP operating in 7-Mode
• E-Series SANtricity OS Controller Software 11.x
• E-Series SANtricity OS Controller Software 8.x
• E-Series SANtricity Storage Manager
• E-Series SANtricity Web Services (REST API) for Web Services Proxy
• Element Plug-in for vCenter Server
• FAS/AFF BIOS
• Host Utilities - SAN for Linux
• Host Utilities - SAN for Windows
• MetroCluster Tiebreaker for clustered Data ONTAP
• NetApp Cloud Backup (formerly AltaVault)
• NetApp Cloud Backup OST Plug-in (formerly AltaVault OST Plug-in)
• NetApp Converged Systems Advisor Agent
• NetApp HCI Storage Nodes
• NetApp Manageability SDK
• NetApp NFS Plug-in for VMware VAAI
• NetApp Plug-in for Symantec NetBackup
• NetApp SANtricity Cloud Connector
• NetApp SANtricity SMI-S Provider
• NetApp SMI-S Provider
• NetApp Service Level Manager
• NetApp SolidFire & HCI Storage Node (Element Software)
• NetApp SteelStore Cloud Integrated Storage
• NetApp Storage Encryption
• NetApp VASA Provider for Clustered Data ONTAP 7.2 and above
• ONTAP Select Deploy administration utility
• OnCommand API Services
• OnCommand Cloud Manager
• OnCommand Insight
• OnCommand System Manager 9.x
• OnCommand Unified Manager for 7-Mode (core package)
• OnCommand Workflow Automation
• Open Systems SnapVault Agent
• RAID Controller CTS2600 Legacy Engenio
• Service Processor
• Single Mailbox Recovery
• Snap Creator Framework
• SnapCenter
• SnapDrive for Unix
• SnapDrive for Windows
• SnapManager for Exchange
• SnapManager for Hyper-V
• SnapManager for MS SQL
• SnapManager for Oracle
• SnapManager for SAP
• SnapManager for Sharepoint
• Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 7.2 and above
• Storage Services Connector
• StorageGRID (formerly StorageGRID Webscale)
• StorageGRID Webscale NAS Bridge
• StorageGRID9 (9.x and prior)
• System Setup
• Virtual Storage Console for VMware vSphere 7.2 and above

Software Versions and Fixes

NetApp's currently available patches are listed below.

Workarounds

None at this time.

Obtaining Software Fixes

Software fixes will be made available through the NetApp Support website in the Software Download section.

https://mysupport.netapp.com/site/downloads/

Customers who do not have access to the Support website should contact Technical Support at the number below to obtain the patches.

Contact Information

Check http://mysupport.netapp.com for further updates.
For questions, contact NetApp at:

Technical Support
mysupport.netapp.com
1 888 4 NETAPP (1 888 463 8277) (U.S. and Canada)
+00 800 44 638277 (EMEA/Europe)
+800 800 80 800 (Asia/Pacific)

Status of This Notice

Final.

This advisory should be considered the single source of current, up-to-date, authorized and accurate information from NetApp regarding Full Support products and versions.

This advisory is posted at the following link:
https://security.netapp.com/advisory/NTAP-20180104-0001

Revision History