Meltdown and Spectre vulnerabilities Intel (and AMD) Chip Bug

Anonymous
2018-01-04T01:54:57+00:00

A lot of noise on the internet, after Intel confirm that chips have a bug:

https://newsroom.intel.com/news/intel-responds-to-security-research-findings/ 

This post is to bring some light on this.

1- Intel says is not only their chips affected

2- PCID (Process-Context Identifiers), a chip feature,  has a bug that allow apps (malware) to read data

3- Process-context identifiers (PCIDs) are a facility by which a logical processor may cache information for multiple linear-address spaces. The processor may retain cached information when software switches to a different linear address space with a different PCID.

4- Macintosh and Linux OS are also affected.

Rumors:

1- If you have Haswell (4th-gen) or newer, PCID (Process-Context Identifiers) is enabled. 

2- After apply the patch, performance is going to be slower on newer CPU. Around 5 to 10%.

2- Still if you have older CPU, performance will be affected worse than newer CPUs.

3- To be affected you must have a OS 64 bits. {Correction: 32bits has vulnerability, MS still working on this)

Just as I'm writing this, Linus Torvalds and his team are working on this too:

https://lkml.org/lkml/2018/1/2/703

https://www.postgresql.org/message-id/20180102222354.qikjmf7dvnjgbkxe%40alap3.anarazel.de

Can we get a word from Microsoft?

For windows, What patch is going to address this? (Update: Patch links and KB are listed on postings)

Is that is going to be on the Montly Rollup and/or Security only patches? (Update: See the links posted)

If performance is going to suffer, can we be able to uninstall such patch? (Update: Microsoft published a document about it, See the links posted)

Please, any info will be appreciated.

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

77 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2018-01-23T19:03:46+00:00

    Stop deployment if you fall into those hardware specs and wait for another firmware update is essentially what I got from it as well.  The good news is it sounds like they're close to a firmware release, which means a new BIOS update for the manufacturers. The bad news is, there's a lot of CPUs effected:

    The following Intel-based platforms are impacted by this issue. Intel may modify this list at a later time. Please check with your system vendor or equipment manufacturer for more information regarding updates for your system.

    • Intel® Core™ i3 processor (45nm and 32nm)
    • Intel® Core™ i5 processor (45nm and 32nm)
    • Intel® Core™ i7 processor (45nm and 32nm)
    • Intel® Core™ M processor family (45nm and 32nm)
    • 2nd generation Intel® Core™ processors
    • 3rd generation Intel® Core™ processors
    • 4th generation Intel® Core™ processors
    • 5th generation Intel® Core™ processors
    • 6th generation Intel® Core™ processors
    • 7th generation Intel® Core™ processors
    • 8th generation Intel® Core™ processors
    • Intel® Core™ X-series Processor Family for Intel® X99 platforms
    • Intel® Core™ X-series Processor Family for Intel® X299 platforms
    • Intel® Xeon® processor 3400 series
    • Intel® Xeon® processor 3600 series
    • Intel® Xeon® processor 5500 series
    • Intel® Xeon® processor 5600 series
    • Intel® Xeon® processor 6500 series
    • Intel® Xeon® processor 7500 series
    • Intel® Xeon® Processor E3 Family
    • Intel® Xeon® Processor E3 v2 Family
    • Intel® Xeon® Processor E3 v3 Family
    • Intel® Xeon® Processor E3 v4 Family
    • Intel® Xeon® Processor E3 v5 Family
    • Intel® Xeon® Processor E3 v6 Family
    • Intel® Xeon® Processor E5 Family
    • Intel® Xeon® Processor E5 v2 Family
    • Intel® Xeon® Processor E5 v3 Family
    • Intel® Xeon® Processor E5 v4 Family
    • Intel® Xeon® Processor E7 Family
    • Intel® Xeon® Processor E7 v2 Family
    • Intel® Xeon® Processor E7 v3 Family
    • Intel® Xeon® Processor E7 v4 Family
    • Intel® Xeon® Processor Scalable Family
    • Intel® Xeon Phi™ Processor 3200, 5200, 7200 Series
    • Intel® Atom™ Processor C Series
    • Intel® Atom™ Processor E Series
    • Intel® Atom™ Processor A Series
    • Intel® Atom™ Processor x3 Series
    • Intel® Atom™ Processor Z Series
    • Intel® Celeron® Processor J Series
    • Intel® Celeron® Processor N Series
    • Intel® Pentium® Processor J Series
    • Intel® Pentium® Processor N Series

    Was this answer helpful?

    0 comments
  2. Anonymous
    2018-01-23T21:41:55+00:00

    Wow they need to figure this out and get these systems patched. The longer it takes the more at risk everyone is. Hackers work pretty fast. I seen where a Bios update would be available for my acer laptop at the end of March but maybe now that will be moved forward .I have it sitting in a faraday cage right now because it has the AMT.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2018-01-25T01:26:34+00:00

    Sadly it is not just computers that are affected but any newer technology that has a chip installed. I am so happy I drive an old car.

    https://www.theatlantic.com/technology/archive/2018/01/spectre-meltdown-cybersecurity/551147/

    Was this answer helpful?

    0 comments
  4. Anonymous
    2018-01-25T18:11:07+00:00

    Was this answer helpful?

    0 comments
  5. Anonymous
    2018-01-26T00:42:11+00:00

    What other are saying is correct.

    Dell posted that removed the BIOS updates affected, but still recommend to install the Win OS patches.

    Microprocessor Side-Channel Vulnerabilities (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754): Impact on Dell products

    Update 01/22/2018:

    Intel has communicated new guidance regarding the "reboot issues" with the microcode included in the BIOS updates released to address Spectre (Variant 2), CVE-2017-5715. Dell is advising that all customers should not deploy the BIOS update for the Spectre (Variant 2) vulnerability at this time. We are removing the impacted BIOS updates from the web and suspending further BIOS updates for affected platforms.

    If you have already applied the BIOS update, please wait for further information and an updated BIOS release, no other action is recommended at this point. Please continue to check back for updates.

    As a reminder, the Operating System patches are not impacted and still provide mitigations to Spectre (Variant 1) and Meltdown (Variant 3). The microcode update is only required for Spectre (Variant 2), CVE-2017-5715.

    Damn, when we are going to see the end of this mess?

    Was this answer helpful?

    0 comments