HP has issued a critical firmware update for a large number of their SSD drives which will fail after 32768 hours of operation.
The defect in the firmware for the SSD drives will cause them to fail and all data on the drive to be permanently lost after 32,768 hours of operation. That’s 3 years, 270 days and 8 hours in real money. Looking suspiciously like an integer overflow defect in the firmware, this serves as a timely reminder to include firmware within the scope of our regular patching cycle. HP warns that: “SSDs which were put into service at the same time will likely fail nearly simultaneously.”
Firmware is the low level software that controls devices like hard drives or network cards. It is also present in computers, firewalls and network appliances. It controls the initial operation of the device before the main operating system is fully loaded and activated.
Vulnerabilities in firmware can cause device failure and data loss or allow device security to be bypassed before the operating system is fully active. For example, Cisco has spent much of 2019 rolling out updates to the firmware of many of its devices to correct a vulnerability on the secure boot firmware that could enable an attacker to install and boot their own malicious software into the firewall.
Firmware is software and can contain vulnerabilities that need patching just like the operating system or desktop applications.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)