{"id":36963,"date":"2018-01-29T13:59:10","date_gmt":"2018-01-29T12:59:10","guid":{"rendered":"http:\/\/e3mag.com\/?p=33229"},"modified":"2024-01-19T14:52:28","modified_gmt":"2024-01-19T13:52:28","slug":"meltdown-spectre-hana","status":"publish","type":"post","link":"https:\/\/e3mag.com\/en\/meltdown-spectre-hana\/","title":{"rendered":"Meltdown, Spectre & Hana"},"content":{"rendered":"

This is not the first time that a security advisory has revealed the vulnerability of PCs and servers. In the case of Meltdown and Spectre, however, many serious IT experts are talking about a security GAU because, although containment of the threat is and will be possible, the effects cannot yet be assessed.<\/p>\n

The difference to previous security problems: Meltdown and Spectre are not about fixing an \"annoying\" programming error, but about a fundamental architectural decision of the processor design.<\/p>

\"Fullsize\"<\/a><\/div>\n

Calculation steps that the processor executes optionally and predictively are not equally secure and comprehensively protected as the \"official\" program code. So that no time is lost waiting for intermediate results, most modern multi-core processors calculate possible results as a \"busywork\" in anticipatory obedience.<\/p>\n

What is not needed is sorted out. What is necessary is then already ready. Unfortunately, this anticipatory diligence task is carried out in the \"no man's land\" of the processor, where correct results are produced, but to the exclusion of all safety measures.<\/p>\n

Future analyses will show to what extent the repair of Meltdown and Spectre will be urgent and necessary because this Security-GAU can be used by criminal machinations. For a Hana user, on the other hand, a completely different question arises: Will the \"repair\" affect the performance of the Hana database?<\/p>\n

Derived from the public knowledge about Meltdown and Spectre and the solutions to eliminate the vulnerability either on BIOS or operating system level, it can be seen that the processor performance is definitely reduced.<\/p>\n

\"Sap<\/a>
Knowledge Base Search in the SAP knowledge base for \"meltdown\": the result from the past seven days (key date: January 22).
There is not much to be found, and what little there is are references to other IT companies - SAP keeps the ball flat and existing customers in the dark.<\/figcaption><\/figure>\n

The renowned IT journal \"Magazin f\u00fcr Computer-Technik\" (c't) has already been able to perform some tests, which were published in the issue of January 20 this year. The result summarized:<\/p>\n

You will hardly notice a significant performance drop on the PC in simple office functions, it can rarely happen in computer games, but clear and noticeable performance drops can be observed in very intensive input\/output commands, as they primarily occur in the database environment.<\/em><\/p>\n

Hana is an in-memory computing database that depends predominantly on the speed of the processor and the size and speed of the caches and main memory.<\/p>\n

Theoretically, therefore, repair measures (patches) at processor level including BIOS (Basic Input\/Output System) and operating system level (Linux from Suse and Red Hat) can significantly influence the overall performance of the Hana database.<\/p>\n

If the Hana database runs in a virtualized system environment (hypervisor), the measures in a VMware system are of course also decisive.<\/p>\n

The existing Hana customer should therefore find answers on SAP's service marketplace, which SAP has developed together with partners Intel, IBM, Suse, Red Hat and VMware. Wrong - see screenshot.<\/p>\n

SAP's silence in the place where the existing customer first looks for advice and help is worrying: Does SAP not know or does SAP not want to say anything about it? How vulnerable are the Hana systems? Why are Intel and IBM, on whose processors Hana runs, silent?<\/p>\n

According to current knowledge, Meltdown and Spectre will have an impact on all in-memory computing databases. This means that Hana (on-premise and cloud) is primarily affected by this security disaster.<\/p>\n

The current situation is very unpleasant and worrying for all existing customers in this respect, because SAP is trying to shift the responsibility to the certified Hana server manufacturers and operating system suppliers, see text of SAP Note 2586312.<\/p>\n

 <\/p>\n

\n

 <\/p>\n

SAP Note: 2586312<\/span><\/h3>\n

Linux: How to protect against speculative execution vulnerabilities? (Version 3 from January 19, 2018)<\/p>\n

In early January 2018, a design flaw in modern CPUs was disclosed. By exploiting this design flaw, user mode applications can gain access to any physical memory, even if the memory is mapped in kernel mode only and thus should not be accessible. The design flaw manifests in several bugs, referred to as Common Vulnerabilities and Exposures. These bugs cannot be fixed in the CPUs themselves, but require both microcode and OS kernel updates. Affected are recent and older CPUs from Intel (Xeon) and IBM (Power), among others.<\/p>\n

SAP strongly recommends to follow the recommendations and apply the updates provided by the hardware vendors, virtualization vendors and OS distributors as appropriate. These updates may impact the system's performance. In virtualized systems, both host OS as well as guest OS should be patched and both can affect performance. The severity of the performance regression depends on the workload and on the CPU type. In virtualized systems, host OS as well as guest OS can be affected.<\/p>\n

Contact the vendor of your server. Look for a BIOS update which includes microcode patches for the actual CPU bug(s). Several servers may require a complete disconnect from power after certain BIOS updates which ship new microcode. Refer to the installation guide for the BIOS update.<\/p>\n

Contact the operating system distributor.
\nInstall the required patches and reboot your host.<\/p>","protected":false},"excerpt":{"rendered":"

While almost the entire IT and business world discusses the security mega-GAU, SAP and IBM remain surprisingly calm and silent towards the community. Only Hana platform supplier Suse is distributing a few tips for in-memory computing.<\/p>","protected":false},"author":38,"featured_media":36735,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"pmpro_default_level":"","footnotes":""},"categories":[161,2,20361],"tags":[65,5179,21127,21140],"coauthors":[19920],"class_list":["post-36963","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-szene","category-sap-nachrichten","category-mag-1802","tag-hana","tag-hana-datenbank","tag-meltdown","tag-spectre","pmpro-has-access"],"acf":[],"featured_image_urls_v2":{"full":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown.jpg",1000,441,false],"thumbnail":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown-150x150.jpg",150,150,true],"medium":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown.jpg",400,176,false],"medium_large":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown-768x339.jpg",768,339,true],"large":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown.jpg",1000,441,false],"image-100":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown-100x44.jpg",100,44,true],"image-480":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown-480x212.jpg",480,212,true],"image-640":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown-640x282.jpg",640,282,true],"image-720":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown-720x318.jpg",720,318,true],"image-960":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown-960x423.jpg",960,423,true],"image-1168":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown.jpg",1000,441,false],"image-1440":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown.jpg",1000,441,false],"image-1920":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown.jpg",1000,441,false],"1536x1536":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown.jpg",1000,441,false],"2048x2048":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown.jpg",1000,441,false],"trp-custom-language-flag":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown.jpg",18,8,false],"bricks_large_16x9":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown.jpg",1000,441,false],"bricks_large":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown.jpg",1000,441,false],"bricks_large_square":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown.jpg",1000,441,false],"bricks_medium":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown.jpg",600,265,false],"bricks_medium_square":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown.jpg",600,265,false],"profile_24":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown-24x24.jpg",24,24,true],"profile_48":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown-48x48.jpg",48,48,true],"profile_96":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown-96x96.jpg",96,96,true],"profile_150":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown-150x150.jpg",150,150,true],"profile_300":["https:\/\/e3mag.com\/wp-content\/uploads\/2018\/04\/Meltdown-300x300.jpg",300,300,true]},"post_excerpt_stackable_v2":"

W\u00e4hrend fast die gesamte IT- und Business-Welt den Security-Mega-GAU diskutiert, bleiben SAP und IBM gegen\u00fcber der Community erstaunlich gelassen und schweigsam. Nur Hana-Plattform-Lieferant Suse verteilt ein paar Tipps f\u00fcr das In-memory Computing.<\/p>\n","category_list_v2":"Szene<\/a>, Community Nachrichten<\/a>, MAG 18-02<\/a>","author_info_v2":{"name":"E-3 Magazine","url":"https:\/\/e3mag.com\/en\/author\/e-3-magazin\/"},"comments_num_v2":"0 comments","_links":{"self":[{"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/posts\/36963","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/users\/38"}],"replies":[{"embeddable":true,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/comments?post=36963"}],"version-history":[{"count":1,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/posts\/36963\/revisions"}],"predecessor-version":[{"id":138163,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/posts\/36963\/revisions\/138163"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/media\/36735"}],"wp:attachment":[{"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/media?parent=36963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/categories?post=36963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/tags?post=36963"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/e3mag.com\/en\/wp-json\/wp\/v2\/coauthors?post=36963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}