Meltdown and Spectre vulnerabilities Intel (and AMD) Chip Bug

Anonymous
2018-01-04T01:54:57+00:00

A lot of noise on the internet, after Intel confirm that chips have a bug:

https://newsroom.intel.com/news/intel-responds-to-security-research-findings/ 

This post is to bring some light on this.

1- Intel says is not only their chips affected

2- PCID (Process-Context Identifiers), a chip feature,  has a bug that allow apps (malware) to read data

3- Process-context identifiers (PCIDs) are a facility by which a logical processor may cache information for multiple linear-address spaces. The processor may retain cached information when software switches to a different linear address space with a different PCID.

4- Macintosh and Linux OS are also affected.

Rumors:

1- If you have Haswell (4th-gen) or newer, PCID (Process-Context Identifiers) is enabled. 

2- After apply the patch, performance is going to be slower on newer CPU. Around 5 to 10%.

2- Still if you have older CPU, performance will be affected worse than newer CPUs.

3- To be affected you must have a OS 64 bits. {Correction: 32bits has vulnerability, MS still working on this)

Just as I'm writing this, Linus Torvalds and his team are working on this too:

https://lkml.org/lkml/2018/1/2/703

https://www.postgresql.org/message-id/20180102222354.qikjmf7dvnjgbkxe%40alap3.anarazel.de

Can we get a word from Microsoft?

For windows, What patch is going to address this? (Update: Patch links and KB are listed on postings)

Is that is going to be on the Montly Rollup and/or Security only patches? (Update: See the links posted)

If performance is going to suffer, can we be able to uninstall such patch? (Update: Microsoft published a document about it, See the links posted)

Please, any info will be appreciated.

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

77 answers

Sort by: Newest
  1. Anonymous
    2018-03-08T02:59:22+00:00

    Thanks for that information. I will keep an eye out at my laptop manufacturer and if they seem to be taking too long I will download the microsoft patch. This is all going to be a nightmare this year as new vulnerabilities are discovered. Already code is starting to be cracked.. Just a race against the bad guys now to see if the chip makers can stay ahead of this.

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2018-03-06T23:48:19+00:00

    If I read correctly, looks like now Microsoft is including  Intel firmware updates on this KB4090007:

    Today, Microsoft will make available Intel microcode updates, initially for some Skylake devices running the most broadly installed version of Windows 10 — the Windows 10 Fall Creators Update v 1709 — through the Microsoft Update Catalog, KB4090007.

    https://support.microsoft.com/en-us/help/4090007/intel-microcode-updates

    And also is warning about risks with AV compatibility.

    https://blogs.windows.com/windowsexperience/2018/03/01/update-on-spectre-and-meltdown-security-updates-for-windows-devices/ 

    Be careful when you authorize patches!

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2018-03-02T18:16:54+00:00

    Another tool to check Meltdown and Spectre vulnerabilities for Win from Ashampoo company. Requires .Net Framework 5 installed.

    https://www.ashampoo.com/en/usd/dld/1304/spectre-meltdown-cpu-checker/

    This other tool is for Linux:

    https://github.com/speed47/spectre-meltdown-checker

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2018-02-22T17:39:41+00:00

    Oh yeah, this is the inspectre tool I mentioned earlier in this thread.  It works really well, but pay attention to the results when running on a Mac or a VM.

    Was this answer helpful?

    0 comments No comments
  5. Anonymous
    2018-02-22T17:33:08+00:00

    Quick Update: another tool to Inspect Windows hardware and software for Meltdown and Spectre vulnerabilities:

    https://www.grc.com/freepopular.htm

    This one gives you a small GUI, and more info. You can also use it  like a command-line utility, for your scripts.

    Have fun!

    Was this answer helpful?

    0 comments No comments