Meltdown and Spectre: CPU vulnerabilities patched

kemical

Windows Forum Admin
Staff member
Premium Supporter
#1
New vulnerabilities have recently been discovered with modern cpu's:
Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.

Meltdown and Spectre work on personal computers, mobile devices, and in the cloud. Depending on the cloud provider's infrastructure, it might be possible to steal data from other customers.
It would seem Intel are more prone to attack than AMD:

Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.

Which systems are affected by Spectre?
Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors.

Which cloud providers are affected by Meltdown?
Cloud providers which use Intel CPUs and Xen PV as virtualization without having patches applied. Furthermore, cloud providers without real hardware virtualization, relying on containers that share one kernel, such as Docker, LXC, or OpenVZ are affected.
Meltdown and Spectre

Microsoft have released patches which will be available via Windows update. If like me yours hasn't arrived then download the standalone version here:

Windows 10:
https://support.microsoft.com/en-us/help/4056892/windows-10-update-kb4056892

Windows 8.1:
https://support.microsoft.com/en-us/help/4056898/windows-81-update-kb4056898

Windows 7:
https://support.microsoft.com/en-us/help/4056897/windows-7-update-kb4056897

(To access the standalone download, scroll down the changelog to 'How to get this update' and click the link)
 


Neemobeer

Windows Forum Team
Staff member
#2
This one is going to suck and I'm not even talking about the security ramifications. Performance is going to be heavily impacted especially for virtual environments. I read as much as a 30% decrease in virtual environments.
 


kemical

Windows Forum Admin
Staff member
Premium Supporter
#3
Hmm... I wonder if it's a sneaky way of getting everyone to buy new 'bug free' chips when made available??
 


Neemobeer

Windows Forum Team
Staff member
#4
Process to verify your system is properly patched.
Patching requires both a patch from Microsoft and a firmware update from your system or motherboard manufacturer (for self built)

  • Open an elevated powershell prompt (Right click, 'Run As Administrator')
  • Type Install-Module SpeculationControl
  • Press A to install all/any modules
  • Type Get-SpeculationControlSettings
If you have any red you are not fully patched. CVE-2017-5754 is the OS patch and CVE-2017-5715 is handled by the firmware update covering install. There is a third CVE which may also be present. As a side note not all vendors have a firmware patch avaliable yet.
 


kemical

Windows Forum Admin
Staff member
Premium Supporter
#5
Any links or further reading?
 


Neemobeer

Windows Forum Team
Staff member
#6
CVEs

Protection Guide
https://support.microsoft.com/en-us...-to-protect-against-the-speculative-execution

Advisory Article
ADV180002 | Guidance to mitigate speculative execution side-channel vulnerabilities


So when the patch is applied you also need to enable these registry keys to enable the mitigations
To enable the mitigations

You can run the two following reg add commands from an elevated command prompt
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 0 /f

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f


***UPDATE***
This is mentioned in the advisory, but you will also want to verify your A/V A/M is compatible with the MS patch. Some security products call undocumented Windows functions. If you don't have a compatible security suite you will likely encounter BSODs as a result.

***UPDATE 2***
Current compatiblity list
CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754 (Meltdown and Spectre) Windows antivirus patch compatibility
 


Last edited:

ragnarok1968

Well-Known Member
#7
Massive Chip Flaw Explained In 3 Minutes

Also

Meltdown and Spectre: ‘worst ever’ CPU bugs affect virtually all computers (infowars)
Meltdown and Spectre: ‘worst ever’ CPU bugs affect virtually all computers (London Guardian)

Serious security flaws that could let attackers steal sensitive data, including passwords and banking information, have been found in processors designed by Intel, AMD and ARM.

The flaws, named Meltdown and Spectre, were discovered by security researchers at Google’s Project Zero in conjunction with academic and industry researchersfrom several countries. Combined they affect virtually every modern computer, including smartphones, tablets and PCs from all vendors and running almost any operating system.

Meltdown is “probably one of the worst CPU bugs ever found”, said Daniel Gruss, one of the researchers at Graz University of Technology who discovered the flaw.

Meltdown is currently thought to primarily affect Intel processors manufactured since 1995, excluding the company’s Itanium server chips and Atom processors before 2013. It could allow hackers to bypass the hardware barrier between applications run by users and the computer’s core memory. Meltdown, therefore, requires a change to the way the operating system handles memory to fix, which initial speed estimates predict could affect the speed of the machine in certain tasks by as much as 30%.

The Spectre flaw affects most modern processors made by a variety of manufacturers, including Intel, AMD and those designed by ARM, and potentially allows hackers to trick otherwise error-free applications into giving up secret information. Spectre is harder for hackers to take advantage of but is also harder to fix and would be a bigger problem in the long term, according to Gruss.

Intel and ARM insisted that the issue was not a design flaw, although it will require users to download a patch and update their operating system to fix.


FacebookTwitterPinterest

‘Intel has begun providing software and firmware updates to mitigate these exploits,’ said the company in statement Photograph: Fabian Bimmer/Reuters
“Intel has begun providing software and firmware updates to mitigate these exploits,” Intel said in a statement, denying that fixes would slow down computers based on the company’s chips. “Any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.”

Google said it informed the affected companies about the Spectre flaw on 1 June 2017 and later reported the Meltdown flaw before 28 July 2017. Both Intel and Google said they were planning to release details of the flaws on 9 January, when they said more fixes would be available, but that their hand had been forced after early reports led to Intel stock falling by 3.4% on Wednesday.

Google and the security researchers it worked with said it was not known whether hackers had already exploited Meltdown or Spectre and that detecting such intrusions would be very difficult as it would not leave any traces in log files.

Dan Guido, chief executive of cybersecurity consulting firm Trail of Bits, said that he expects hackers will quickly develop code they can use to launch attacks exploiting the vulnerabilities. He said: “Exploits for these bugs will be added to hackers’ standard toolkits.”

Researchers said Apple and Microsoft had patches ready for users for desktop computers affected by Meltdown, while a patch is also available for Linux. Microsoft said it was in the process of patching its cloud services and had released security updates on 3 January for Windows customers.

“All Mac systems and iOS devices are affected, but there are no known exploits impacting customers at this time,” said Apple in a blog post, in reference to the fact that although the security flaws make it possible to steal data using malicious software, there was no evidence to suggest that this had happened.

The company advised customers to update their devices’ operating systems and only download software from “trusted sources such as the App Store”.

Google said that Android devices running the latest security updates were protected, including its own Nexus and Pixel devices, and that users of Chromebooks would have to install updates.

ARM said that patches had already been shared with the companies’ partners.

AMD said it believes there “is near zero risk to AMD products at this time.”

Cloud services are also affected by the security problems. Google said it updated its G Suite and cloud services, but that some additional customer action may be needed for its Compute Engine and some other Cloud Platform systems.

Amazon said all but a “small single-digit percentage” of its Amazon Web Services EC2 systems were already protected, but that “customers must also patch their instance operating systems” to be fully protected.

It was not immediately clear whether Intel would face any significant financial liability arising from the reported flaw.

“The current Intel problem, if true, would likely not require CPU replacement in our opinion. However the situation is fluid,” Hans Mosesmann of Rosenblatt Securities in New York said in a note, adding it could hurt the company’s reputation.
Apparently, and Intels CEO has been mum, but this has been known for 2 months already and just now getting out. I heard class action suits exploding against Intel because they KNEW about this flaw and it was part of the design on purpose to allow the US government to access our systems at will.

I have heard this flaw issue has been patched by Microsoft already. But we will see how this pans out. This flaw appears to have been there forever
 


ragnarok1968

Well-Known Member
#8
my question: Since Intel knew about the flaw, it was purposely created how can Intel stand there with a straight face and say they will detail the flaw... that's like asking someone to say how they cut the brake lines so to speak. Well, we'll act stupid and say this and that, but we designed these chips this was since 1995. about when the x86 market was warming up
 


ragnarok1968

Well-Known Member
#10
@kemical Yeah, I saw that. MSFT was probably the first one. But this is damaging because it has been reported, it is a flaw they have known about for many years, theory is that it started in 1995.

This is huge. Now if this was a backdoor to monitor our systems, which is a huge accusation/allegation, Intel will have to close that issue the next generation of CPU's. I see no other way around this. can't keep producing CPU's with a flaw created on purpose.
 


nmsuk

Windows Forum Admin
Staff member
Premium Supporter
#11
infowars are a source, a more untrustworthy site I've yet to find. Simply there are three variants. Intel suffer from all, AMD from variant 2 which is also the most difficult to patch, its also only of use if you have local access and really know what you're doing.
 


ragnarok1968

Well-Known Member
#12
infowars are a source, a more untrustworthy site I've yet to find. Simply there are three variants. Intel suffer from all, AMD from variant 2 which is also the most difficult to patch, its also only of use if you have local access and really know what you're doing.
I understand you personal feelings on this. But the crux of my entire post is that, this is a problem, regardless of news source. But the fact that it has been a problem that was confronted a couple months ago, a problem that has been a purposely made flaw.

disregard the source. Look at the story. What gets me is, its appearing that this has been a well known but a silence on the part of Intel,AMD and Atom surely signify a massive issue.

Now by simple mathematics, not in anyway to insult your intelligence, But it would seem that these flaws are on 3 different platforms, each affected by either one or more variants. Now fairly current word is, these flaws were well known and now coming to light. And these flaws date back to 1995 so Windows 95 era. this is a flaw, that is 22 years old. So with this logic in a big picture view, the chip makers knew of it. This is why there's apparently a class action against Intel and the CEO was mute until recently. but tomorrow (9th) Intel will supposedly address the flaw.

My theory?
I honestly think it was meant for government access to our systems. think about it a second, We have this 22 year old flaw, what we now know was known all along. Mesh with that, the wikileaks reports on CIA tools to spy on the peoples PC's. Think CIA level tools that Assange and I think guccifer 2.0 found.

I'm not a conspiracy theorist, but too many unanswered question at this point but too many things in the light not to form a general conclusion as such.
 


ragnarok1968

Well-Known Member
#13
to add: Is there a commonality to this flaw and intels kill switch for sandy bridge? Intel's Sandy Bridge processors have a remote kill switch

there have been plans to have controls in place by the past administration to give control of our internet the the UN Obama gives away the internet and, with it, our liberty

I like to sit quietly, be patient and watch.
 


kemical

Windows Forum Admin
Staff member
Premium Supporter
#14
Perhaps it's a back door to the matrix?
 


Neemobeer

Windows Forum Team
Staff member
#15
Well speculative execution is technically a feature, but can also be a vulnerability as denoted by these CVEs. My bet is Intel didn't want to address it because it's presently about the only performance advantage they have (HAD) over AMD.
 


nmsuk

Windows Forum Admin
Staff member
Premium Supporter
#16
EPIC the gaming company patched their Fortnite servers and performance has tanked. Isn't looking good for Intel.
 


Neemobeer

Windows Forum Team
Staff member
#17
Yeah it's up to a 30% hit on virtualized environments
 


nmsuk

Windows Forum Admin
Staff member
Premium Supporter
#18
Guess there will be a transition to epyc from AMD soon then. Having an AMD myself feel a little on the smug side ;)
 


nmsuk

Windows Forum Admin
Staff member
Premium Supporter
#20
Well it's really bad for intel but for AMD it's so hard to exploit no ones going to bother. The Intel flaws are easily leveraged and automated. Spectre on AMD really isn't. You need local access and actually have to know what you're doing as it can't be automated. So still feeling a tad smug.
 


This website is not affiliated, owned, or endorsed by Microsoft Corporation. It is a member of the Microsoft Partner Program.
Top