Getac Technology Corporation Statement for 2024H1 Security Update    

NOTICE:

Getac Technology Corporation (“Getac”) continues to work on qualifying and applying the fixes provided by Intel Corporation (“Intel”) / Insyde Software Corp. (“Insyde”) on supported Getac systems. Please refer to the table below to identify fixes for your systems.

Release Date: 23^rd Aug, 2024

Latest Release Date: 23^rd Aug, 2024

Summary: 

Intel SA-01051: A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing microcode updates to mitigate this potential vulnerability. (link)

Intel SA-01046: A potential security vulnerability in some Intel® Processor stream cache mechanisms may allow escalation of privilege. Intel is releasing microcode updates to mitigate this potential vulnerability. (link)

Intel SA-00993: Potential security vulnerabilities in some Intel® Ethernet tools and driver install software may allow escalation of privilege. Intel is releasing software updates to mitigate these potential vulnerabilities. (link)

Intel SA-00982: A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing a firmware update to mitigate this potential vulnerability. (link)

Intel SA-00972: A potential security vulnerability in the bus lock regulator mechanism for some Intel® Processors may allow denial of service. Intel is releasing firmware updates to mitigate this potential vulnerability.(link)

Intel SA-00961: A potential security vulnerability in some Intel® Rapid Storage Technology software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. (link)

Intel SA-00950: A potential security vulnerability in some Intel® Processors may allow escalation of privilege and/or information disclosure and/or denial of service via local access. Intel is releasing firmware updates to mitigate this potential vulnerability. (link)

Intel SA-00947: Potential security vulnerabilities in some Intel® PROSet/Wireless and Intel® Killer™ Wi-Fi software may allow escalation of privilege, information disclosure or denial of service. Intel is releasing software updates to mitigate these potential vulnerabilities. (link)

Intel SA-00944: A potential security vulnerability in the Intel® Connectivity Performance Suite software for some Intel® Wireless Products may allow information disclosure. Intel is releasing software updates to mitigate this potential vulnerability. (link)

Intel SA-00929: A potential security vulnerability in BIOS firmware for some Intel® Processors may allow escalation of privilege. Intel is releasing BIOS updates to mitigate this potential vulnerability. (link)

Intel SA-00928: Potential security vulnerabilities in some Intel® Chipset Driver Software may allow escalation of privilege. Intel is releasing software updates to mitigate these potential vulnerabilities. (link)

Intel SA-00923: Potential security vulnerabilities in the Intel® Converged Security Management Engine (CSME) installer, Intel® Local Manageability Service software and Intel® Server Platform Servcies (SPS) may allow information disclosure, escalation of privilege, or denial of service.(link)

Intel SA-00898: A potential security vulnerability in some Intel® Atom® Processors may allow information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability. (link)

Intel SA-00870: A potential security vulnerability in some Intel® Chipset Device Software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. (link)

Intel SA-00864: Potential security vulnerabilities in some Intel® Graphics drivers may allow escalation of privilege, denial of service and information disclosure. Intel is releasing software updates to mitigate these potential vulnerabilities. (link)

Intel SA-00851: Potential security vulnerabilities in some Intel® Thunderbolt™ Declarative Componentized Hardware (DCH) drivers for Windows may allow escalation of privilege, denial of service, and/or information disclosure. Intel is releasing software updates to mitigate these potential vulnerabilities. (link)

Insyde SA-2023040: IhisiServiceSmm: A vulnerability in the module that could allow an attacker to modify UEFI variables. (link)

Insyde SA-2023047: SysPasswordDxe: Cleartext storage of system password could lead to possible information disclosure. (link)

Insyde SA-2023048: Upgrade FreeType Build Tool to version 2.13.0. (link)

Insyde SA-2023054: AsfSecureBootDxe: Stack buffer overflow vulnerability leading to arbitrary code execution during DXE phase. (link)

Insyde SA-2023055: CsmInt10HookSmm: SMM memory corruption vulnerability in SMM driver (SMRAM write). (link)

Insyde SA-2023056: IhisiServicesSmm: Arbitrary calls to SetVariable with unsanitized arguments in SMI handler. (link)

Insyde SA-2023053: Improper input validation may be exploited via local access. (link)

Insyde SA-2023059: IH2O-0802-2301 Code change to accommondate OpenSSL 1.1.1v (link)

Insyde SA-2023031: VU#275256 Vulnerabilities in EDK2 Reference implementation of the UEFI Specification. (link)

Insyde SA-2023066: VU#132380 Vulnerabilities in EDK2 NetworkPkg IP stack implementation. (link)

Insyde SA-2023067: PnpSmm: Possible out of bounds in SMM communication buffer, leading to tampering. (link)

Getac Affected Products and Recommendation:

1.      For certain products currently being manufactured or already in the field, Getac will also release solutions for the update. Please check the affected products in the table below: 

2.      The latest version solution is backwards-compatible with the previous version.

GETAC AFFECTED PRODUCTS AND SOLUTION (Intel SA-00961)

* Please note that the schedule above is subject to change due to the test status. 

GETAC AFFECTED PRODUCTS AND SOLUTION (Intel SA-00947)

* Please note that the schedule above is subject to change due to the test status. 

GETAC AFFECTED PRODUCTS AND SOLUTION (Intel SA-00944)

* Please note that the schedule above is subject to change due to the test status. 

GETAC AFFECTED PRODUCTS AND SOLUTION (Intel SA-00993)

* Please note that the schedule above is subject to change due to the test status. 

GETAC AFFECTED PRODUCTS AND SOLUTION (Intel SA-00928 / Intel SA-00870)

* Please note that the schedule above is subject to change due to the test status. 

GETAC AFFECTED PRODUCTS AND SOLUTION (Intel SA-00923)

* Please note that the schedule above is subject to change due to the test status. 

GETAC AFFECTED PRODUCTS AND SOLUTION (Intel SA-00864)

* Please note that the schedule above is subject to change due to the test status.  

GETAC AFFECTED PRODUCTS AND SOLUTION (Intel SA-00851)

* Please note that the schedule above is subject to change due to the test status. 

GETAC AFFECTED PRODUCTS AND SOLUTION (Intel SA-01046/ Intel SA-00982/ Intel SA-00972/ Intel SA-00950/ Intel SA-00929/ Intel SA-00898/ All Insyde SAs)

* Please note that the schedule above is subject to change due to the test status.

Getac Disclaimer:

All content and other information mentioned in this statement or offered arising from the issue described herein are provided on an “as is ” basis. Getac hereby expressly disclaims any warranties of any kind, express or implied, including without limitation warranties of merchantability, fitness for any particular purpose, non-infringement of intellectual property. All products, information, and figures specified are preliminary based on current expectations and Getac reserves the right to change or update any content thereof at any time without prior notice. Getac assessments have been estimated or simulated using Getac internal analysis or architecture simulation or modeling, and may not represent the actual risk to the users’ local installation and individual environment. Users are recommended to determine the applicability of this statement to their specified environments and take appropriate actions. The use of this statement, and all consequences of such use, is solely at the user’s own responsibility, risk, and expense thereof. In no event shall Getac or any of its affiliates be liable for any and all claims, damages, costs or expenses, including without limitation, loss of profits, loss of data, loss of business expectancy, compensatory, direct, indirect, consequential, punitive, special, or incidental damages or business interruption arising out of or in connection with related to the information contained herein or actions that the user decides to take based thereon. Getac reserves the right to interpret this disclaimer and update this disclaimer whenever necessary.