Meltdown and Spectre vulnerabilities Intel (and AMD) Chip Bug

Microsoft release a document about the loss of performance for this round of patches.

Understanding the performance impact of Spectre and Meltdown mitigations on Windows Systems

• With Windows 10 on newer silicon (2016-era PCs with Skylake, Kabylake or newer CPU), benchmarks show single-digit slowdowns, but we don’t expect most users to notice a change because these percentages are reflected in milliseconds.
• With Windows 10 on older silicon (2015-era PCs with Haswell or older CPU), some benchmarks show more significant slowdowns, and we expect that some users will notice a decrease in system performance.
• With Windows 8 and Windows 7 on older silicon (2015-era PCs with Haswell or older CPU), we expect most users to notice a decrease in system performance.
• Windows Server on any silicon, especially in any IO-intensive application, shows a more significant performance impact when you enable the mitigations to isolate untrusted code within a Windows Server instance. This is why you want to be careful to evaluate the risk of untrusted code for each Windows Server instance, and balance the security versus performance tradeoff for your environment.

Always test before you deploy on production.

Another update, this one comes from VMWare. 

VMware pulled back the patches for ESXi, for VMSA-2018-0004 and will wait for Intel to release the new update,

https://kb.vmware.com/s/article/52345

The Microsoft ADV180002, talk about the speculative execution side-channel vulnerabilities.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002

There are 3  vulnerabilities:

CVE-2017-5753 - Bounds check bypass

CVE-2017-5715 - Branch target injection

CVE-2017-5754 - Rogue data cache load

If you update for your  Microsoft OS, and your Antivirus, you only are protected for 

CVE-2017-5753 - Bounds check bypass

CVE-2017-5754 - Rogue data cache load

You really need your firmware update to be protected for 

CVE-2017-5715 - Branch target injection

Having say that, for Win 2016 Hyper V host there is a way to mitigate this vulnerability CVE-2017-5715 - Branch target injection, until your OEM release firmware.

https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/CVE-2017-5715-and-hyper-v-hosts

Just to clarify, with this vulnerability a VM van read data from another VM, or even the host. You can imagine how bad that can be, specially with companies that host VM from other companies.

Now, what this doc recommends to do is to assign CPU to VM, isolating data.

Be VERY careful!. Test before you go to production servers.

For our company, after several talks, we decided to wait for the firmware. 

So, its up to you if you want to give it a go.

Happy Patching!

Exactly, Darren_I!.

For my company, impossible to uninstall/install Symantec AV on 2,000 computers/servers. 

Last word on Symantec?:

January 17th is the current eta for the hotfix release.

https://www.symantec.com/connect/forums/latest-win10-update-corrupts-sep14#comment-11955001

I can't blame them. Several companies are working on same issue. 

Dell is saying that will release firmware on Feb/1/2018 for some servers.

Microprocessor Side-Channel Vulnerabilities (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754): Impact on Dell EMC products (Dell Enterprise Servers, Storage and Networking)

This is a major issue, that several IT layers are affected.

Another update, this one for Virtualization.

If you do the updates on Hyper-V hosts, remember that you are actually affecting the way the CPU is working.

Means that if you try to do a live migration between Hyper V hosts, make sure that all are patched. Or if you have physical cluster, all nodes need to be patched the same.

The same when you are patching your VMs. Turn them all the way off. Do not do a restart.

No surprise here, but MS still issued a warning.

Warning: live migration will fail between hosts with the updated firmware and hosts without the updated firmware.

https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/CVE-2017-5715-and-hyper-v-vms

Now, for VMware, they are also releasing updates. Affected products:

• VMware vCenter Server (VC)
• VMware vSphere ESXi (ESXi)
• VMware Workstation Pro / Player (Workstation)
• VMware Fusion Pro / Fusion (Fusion)

Same thing as hyper V. See links:

VMware vSphere, Workstation and Fusion updates add Hypervisor-Assisted Guest Remediation for speculative execution issue

VMware ESXi, Workstation and Fusion updates address side-channel analysis due to speculative execution.

Happy patching!!!