HP Printers - Advisory: Meltdown and Spectre CPU Vulnerabilities

Version 1.3 Public
Security Advisory
HP Enterprise Printing Communication:
Meltdown & Spectre CPU Vulnerabilities
Jan 17
th
, 2018 (Revision History)
On January 3
rd
, 2018 Google’s Project Zero and academic institutions announced vulnerabilities in
common CPU platforms. The vulnerabilities impact Intel x86 processors and certain AMD and ARM
processors.
The Spectre and Meltdown vulnerabilities affect microprocessors utilizing speculative execution
and indirect branch prediction. It may allow unauthorized disclosure of information to an attacker
with local user access via a side-channel analysis.
These vulnerabilities could allow a malicious process to read memory of other software
processes. This would require installation of malicious code to perform a successful exploit.
The following security features mitigate loading untrusted or tampered code on HP devices:
o Digital signing of printer firmware and firmware updates
o Digital signing of printer solutions code
o HP SureStart and Secure Boot / ROM based code validation
o Whitelisting and Code Integrity Validation
o Runtime Intrusion Detection
o Run-time Code Integrity that ensures Executable Memory is Write-Protected
For additional information on these security features see the References section
The following HP print devices use x86 and ARM processors that are susceptible to these
vulnerabilities. One or more of the above security features mitigate loading untrusted or
tampered code on these devices.
 HP LaserJet Enterprise printers and multifunction printers
 HP LaserJet Enterprise pre-FutureSmart printers and multifunction printers
 HP LaserJet Pro printers and multifunction printers
 HP PageWide Enterprise printers and multifunction printers
HP Inc.
1501 Page Mill Road
Palo Alto, CA 94304
HP.com