Meltdown and Spectre vulnerabilities mitigation recommendations for Genetec products

Two potential security vulnerabilities affecting Windows operating systems and Intel^® processors have been discovered. These vulnerabilities may lead to unauthorized access to information.

*January 31st, 2018 update below*

Intel^® has issued a new advisory urging its OEMs, software vendors, and end users to stop the deployment of its Spectre patch because it was causing system reboots for some of its systems.

Therefore, HP and Dell removed the microcode updates that were previously available and will issue revised updates once they become available. Microsoft also issued an out of cycle KB4078130 (Catalog, Description) which essentially disables the mitigation for CVE-2017-5715 (Spectre Variant 2). This update targets all systems that have been patched with Intel^®’s recalled microcode.

We recommend our customers to update their system in accordance with what is prescribed in the table below but refrain from updating the microcode at the moment. Customers who have already applied the recalled microcode on their system should apply Windows KB4078130.

Further updates will be made to this security advisory when a new microcode becomes available.

On January 3^rd, 2018, two potential security vulnerabilities were disclosed publicly. The Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5753, CVE-2017-5715) vulnerabilities may lead to unauthorized access to information on a Windows system. To exploit these vulnerabilities, one must have the ability to execute code on the targeted device.

These vulnerabilities affect Windows operating systems running on Intel^® processors (Meltdown & Spectre) and AMD processors (Spectre).

Some Genetec products include a combination of the Windows operating systems and Intel® processors (Streamvault™ appliances, Synergis™ Cloud Link, AutoVu™ Sharp cameras). Also, Security Center can be installed on these components. Therefore, these vulnerabilities could be utilized to gain unauthorized access to information stored by Genetec products, while this has never been observed in the past.

Microsoft released an advisory offering guidance and patches for Windows clients (KB 4073119), Windows Servers (KB 4072698) as well as a PowerShell Script (Speculation Control Validation PowerShell Script) validating that the patches were successfully applied. Microsoft also specifies that a processor microcode or firmware update must be installed along with the Windows patches for customers to be fully protected against the vulnerabilities.

The Genetec team has been testing its products over the last few days to quantify the possible impacts as described hereunder. Along with the performance impact, we are also assessing the potential risk posed by these vulnerabilities for each of our products.

Please see the list of possible affected Genetec products and available patches below.

Note: the Synergis™ Cloud Link cell has been updated on 01/18/2018 to emphasize that the window patch needs to be applied after Softwire 10.6 has been installed.

*This represents the percentage of increase in CPU. For example, if the CPU was used originally at 10% and the patch performance impact in the table above is 25%, then the actual CPU usage will be 12.5% after the patch is applied. This performance impact is not necessarily noticeable by the user.

This advisory will be updated if other relevant facts come to light in the future.

Additional references

HP Meltdown and Spectre security advisory page with chipset update link

Dell Meltdown and Spectre security advisory page with chipset update link

Do not hesitate to contact the Genetec Security Team for more information.