Home / Security / Advisories / NTAP-20191113-0003

NTAP-20191113-0003 — Intel SA-00210 Processor Vulnerability in NetApp Products

Published 2019-11-13 · Updated 2020-06-08 · Status: Final · Exploitation: Public · Severity: not scored · ONTAP affected: Yes

Official advisory: NTAP-20191113-0003 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: Active IQ Unified Manager · ONTAP · E-Series / SANtricity · Other NetApp products · Cloud Backup / AltaVault / SteelStore · SolidFire / NetApp HCI · StorageGRID | ONTAP-relevant

CVEs in this advisory

CVE-2018-12207 · site index

Impact

Successful exploitation of this vulnerability could lead to Denial of Service (DoS) via local access. <br><br> For virtualized deployments, NetApp recommends working with your hypervisor and cloud platform vendors to ensure that your NetApp product is running on a secure and patched platform. For Docker-based deployments, NetApp recommends working with your operating system and hardware vendors to ensure that your NetApp product is running on a secure and patched platform.

Affected products

Active IQ Unified Manager (formerly OnCommand Unified Manager) for VMware vSphere 9.5 and above
Clustered Data ONTAP
Data ONTAP operating in 7-Mode
E-Series SANtricity OS Controller Software 11.x
FAS/AFF BIOS
NetApp Cloud Backup (formerly AltaVault)
NetApp HCI Compute Node (Bootstrap OS)
NetApp HCI Compute Node BIOS
NetApp HCI Storage Node BIOS
NetApp SolidFire & HCI Management Node
NetApp SolidFire & HCI Storage Node (Element Software)
NetApp SteelStore Cloud Integrated Storage

References

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00210.html ↗

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.