SIEM is a closed system. As a result, unprivileged local users can't execute arbitrary code, which helps minimize hardware platform vulnerabilities. Lately, the frequency of hardware security vulnerabilities being identified has been increasing. Some of the vulnerabilities identified are described in the following:

• SB10226 - Security Bulletin - Updates for microprocessors side channel analysis vulnerabilities CVE-2017-5715, CVE-2017-5753, and CVE-2017-5754 (Meltdown/Spectre)
• INTEL-SA-00087
• INTEL-SA-00088
• INTEL-SA-00115
• INTEL-SA-00086

You must upgrade the BIOS to correct some of these vulnerabilities. Sometimes, an operating system kernel upgrade is also needed. When discovered, updates for SIEM are released to address the vulnerabilities. This article explains how to upgrade the BIOS of SIEM Gen4 and Gen5 hardware.

Technical Support recommends that SIEM users download the latest updates to make sure that these vulnerabilities are addressed.


 

• CVE-2017-5703
• CVE-2017-5706
• CVE-2017-5709
• CVE-2017-5715 
• CVE-2017-5753 
• CVE-2017-5754
• CVE-2018-3639

How to identify your Intel Board and BIOS version:

1. Establish an SSH connection to the appliance.
2. Run the command dmidecode | more. 
3. Look for the Product Name and Version. The Product Name contains the Intel Board name and the Version contains the BIOS version. See the following example for reference:

SIEM Gen 4 hardware BIOS upgrade
Recommended BIOS and SIEM software upgrade for Grizzly users:

• BIOS 02.06.0007
• SIEM 11.1.0 and later or SIEM 10.3.0 and later

NOTE: BIOS firmware version 02.06.0006 or higher must be installed before you can upgrade to 02.06.0007. If the current firmware version is below this minimum requirement, upgrade it to version 02.06.0006 first. The firmware is available on the Intel Driver and Software download site.

Recommended BIOS and SIEM software upgrade for RainbowPass users:

• BIOS 03.04.0006
• SIEM 11.1.0 and later or SIEM 10.3.0 and later

NOTES:

• If you experience issues, open a Service Request with Technical Support and request assistance.
• The screen goes blank for several minutes as the backup BIOS is updated. Don't reboot or turn off your system during this process. Power cycling during this process can lead to corruption of the BIOS. You can go to the BIOS setup "F2" during POST to verify updated BIOS/BMC/ME and FRUSDR versions.

SIEM Gen 5 hardware BIOS upgrade

• BIOS 03.01.0038
• SIEM 11.1.0 and later or SIEM 10.3.0 and later

• BIOS 01.01.0027
• SIEM 11.1.0 and later or SIEM 10.3.0 and later

Instructions for BIOS upgrade for both Gen 4 and Gen 5 hardware
Make sure that you read the notes listed above for additional information. The notes apply to Gen 4 and Gen 5 hardware as you complete the following steps.

IMPORTANT: Don't interrupt the BIOS upgrade process once it's started.

1. Download the BIOS for your device model from the Product Downloads site.
2. Format the jump drive to FAT32.
3. Place the contents of the BIOS upgrade at the root of the jump drive. Make sure that there's no parent folder. The startup.nsh script must be at the root of the jump drive.
4. Wipe out the BIOS password so the utility has access. After the password is wiped out, press the F10 key to Save and Reboot.
   
   NOTE: You must use the administrator password (@ppl1@nc3) when entering the BIOS. If the option to clear the Administrator password is grayed out, you might not have used @ppl1@nc3 and might have entered the user level password.
    
5. Plug in the jump drive to the server.
6. Reboot the appliance and allow the automatic script to find the update on the jump drive (press F6 to choose boot device to "EFI" as needed).
7. Allow the script to run. Don't interfere with it.
8. When you see the message The system software stack update process is now complete and the USB Device can be removed, turn off the system using the front power button.
9. Remove the USB jump drive, and then turn on the server using the front power button.