Meltdown and Spectre - Processor Speculative Execution Vulnerabilities (NI Linux Real-Time)

The Meltdown and Spectre vulnerabilities are unspecific to any one vendor and take advantage of techniques commonly used in most modern processor architectures. This means a large range of products are affected. Mitigations could include updates to both OSs and firmware (BIOS).

NI recommends customers follow security best practices to protect against exploitation of vulnerabilities. These practices include adopting software updates, avoiding unrecognized hyperlinks and websites, not downloading files or applications from unknown sources, and following secure password policies. 

NI has observed some negative system performance impact from applying the mitigations. Generally, performance degradation is in line with reports from the industry. In some cases, the impact could be significant but is specific to the application. Due to the system performance impact, these mitigations may be disabled by default. 

NI Linux Real-Time distributions based on LabVIEW Real-Time 2019 and later (linux kernel 4.14+RT or later and firmware version 7.0 or later) ship with several security mitigations addressing the following CVEs:

• CVE-2017-5715 (aka. Spectre v2) 
• CVE-2017-5754 (aka. Meltdown) 
• CVE-2018-3620, CVE-2018-3646 (aka. L1 Terminal Fault Attack) 
• CVE-2018-3639 (aka. Spectre v4) 

Depending on the NI Linux Real-Time controller, you may need to perform one or more of the following steps.

• Apply the BIOS update provided by NI for the controller. Refer to the "Affected Products" section below.
• Upgrade to Firmware (safemode OS) version 7.0, format, and re-install software to the controller.
• Enable the mitigations in the operating system.  
   

For more information on upgrading the firmware and enabling the mitigations in the OS, please refer to Enabling Security Mitigations for Meltdown and Spectre on NI Linux Real-Time Controllers.

NI Linux Real-Time (Intel x64) Controller List 

A BIOS update and a Firmware update is necessary to address Meltdown, Spectre Variant 1, 2 & 4, and Foreshadow (as of 6/1/2019).

*To upgrade your ISC hardware to BIOS version 1.10.05 contact NI Technical Support at ni.com/support. 

CompactDAQ/CompactRIO/Vision/OEM Controller (NI Linux Real-Time ARM) List

A Firmware update to 7.0 for ARM-based controllers is necessary to address Spectre Variant 1 & 2 before enabling mitigations (As of 6/1/2019).

For more information on the update process, refer to Upgrading Firmware on my NI Linux Real-Time Devices and Enabling Security Mitigations for Meltdown and Spectre on NI Linux Real-Time Controllers.

• Meltdown and Spectre - Processor Speculative Execution Vulnerabilities for Window
• Meltdown and Spectre
• CVE-2017-5715
• CVE-2017-5753 
• CVE-2017-5754
• CERT Vulnerability Note VU#584653
• Facts About the New Security Research Findings and Intel Products
• Understanding the Performance Impact of Spectre and Meltdown Mitigations on Windows Systems
• Microcode Update Guidance
• Windows Client Guidance for IT Pros to Protect Against Speculative Execution Side-Channel Vulnerabilities