Meltdown and Spectre vulnerabilities Intel (and AMD) Chip Bug

The Microsoft ADV180002, talk about the speculative execution side-channel vulnerabilities.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002

There are 3  vulnerabilities:

CVE-2017-5753 - Bounds check bypass

CVE-2017-5715 - Branch target injection

CVE-2017-5754 - Rogue data cache load

If you update for your  Microsoft OS, and your Antivirus, you only are protected for 

CVE-2017-5753 - Bounds check bypass

CVE-2017-5754 - Rogue data cache load

You really need your firmware update to be protected for 

CVE-2017-5715 - Branch target injection

Having say that, for Win 2016 Hyper V host there is a way to mitigate this vulnerability CVE-2017-5715 - Branch target injection, until your OEM release firmware.

https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/CVE-2017-5715-and-hyper-v-hosts

Just to clarify, with this vulnerability a VM van read data from another VM, or even the host. You can imagine how bad that can be, specially with companies that host VM from other companies.

Now, what this doc recommends to do is to assign CPU to VM, isolating data.

Be VERY careful!. Test before you go to production servers.

For our company, after several talks, we decided to wait for the firmware. 

So, its up to you if you want to give it a go.

Happy Patching!

Exactly, Darren_I!.

For my company, impossible to uninstall/install Symantec AV on 2,000 computers/servers. 

Last word on Symantec?:

January 17th is the current eta for the hotfix release.

https://www.symantec.com/connect/forums/latest-win10-update-corrupts-sep14#comment-11955001

I can't blame them. Several companies are working on same issue. 

Dell is saying that will release firmware on Feb/1/2018 for some servers.

Microprocessor Side-Channel Vulnerabilities (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754): Impact on Dell EMC products (Dell Enterprise Servers, Storage and Networking)

This is a major issue, that several IT layers are affected.

Another update, this one for Virtualization.

If you do the updates on Hyper-V hosts, remember that you are actually affecting the way the CPU is working.

Means that if you try to do a live migration between Hyper V hosts, make sure that all are patched. Or if you have physical cluster, all nodes need to be patched the same.

The same when you are patching your VMs. Turn them all the way off. Do not do a restart.

No surprise here, but MS still issued a warning.

Warning: live migration will fail between hosts with the updated firmware and hosts without the updated firmware.

https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/CVE-2017-5715-and-hyper-v-vms

Now, for VMware, they are also releasing updates. Affected products:

• VMware vCenter Server (VC)
• VMware vSphere ESXi (ESXi)
• VMware Workstation Pro / Player (Workstation)
• VMware Fusion Pro / Fusion (Fusion)

Same thing as hyper V. See links:

VMware vSphere, Workstation and Fusion updates add Hypervisor-Assisted Guest Remediation for speculative execution issue

VMware ESXi, Workstation and Fusion updates address side-channel analysis due to speculative execution.

Happy patching!!!

Definitely a viable option for home or personal computers.   It becomes more complicated when you are tracking network/malware activity for 500+ workstations.

Or just uninstall your av software.  Defender will keep you plenty safe unless you download random crap and visit odd websites.  Then install at again when its fixed.

These av products shouldn't be doing that anyways.  They are acting like root kits.  Unacceptable if you ask me.