Let’s hear it for beta testing. Early this morning, Microsoft officially announced that it was pulling all of this month’s Meltdown/Spectre patches fo
[See the full post at: Microsoft yanks all of this month’s Windows patches for “devices with impacted AMD processors”]
|
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
-
Microsoft yanks all of this month’s Windows patches for “devices with impacted AMD processors”
- This topic has 80 replies, 30 voices, and was last updated 4 years, 8 months ago by
.
AuthorViewing 39 reply threadsAuthor-
I just rechecked my Windows update. (it’s set to never check).
KB4056894 is now checked.
It was unchecked on 1/4/18.Dell Inspiron 660 (purchased in 2013) just replaced hard drive in November 2017 and had Windows 7 reloaded.
Windows 7 Home Premium 64 bit SP 1
Server 2008 R2 x64
Processor: Intel i3-3240 (ivy bridge 3rd generation)
chipset Intel (R) 7 series/C216
chipset family SATA AHCI Controller -1 E02After new hard drive installed went to
Group A -
-
-
-
Has anyone to date doucmented how, in technical terms, these patches mitigate the vulnerabilities?
Do they rewrite the microcode so that processors stop doing speculative execution?
Do they change the browsers so that they can’t be compromised via Javascript?
Do they make the kernel zero out buffers when they’re deallocated?
What we have is wording like this (from the KB4056894 page for Win 7 / Server 2008):
This security update includes improvements and fixes that were a part of update KB4054518 (released December 12, 2017) and addresses the following issues:
- Security updates to Windows SMB Server, Windows Kernel, Microsoft Graphics Component, Internet Explorer, and Windows Graphics.
And this (KB4056895 for Win 8.1, Server 2012):
This security update includes improvements and fixes that were a part of update KB4054519 (released December 12, 2017) and addresses the following issues:
- Security updates to Windows Kernel, Windows Datacenter Networking, Windows Graphics, and Internet Explorer.
Wouldn’t it be nice to know more about what’s technically being done to our computing environments so that we could understand the risks?
Not only are there gotchas built into the cumulative “all or nothing” path, but there are also ramifications of the policy changes at Microsoft toward reducing technical documentation to “we fixed, it, trust us.”
-Noel
-
Here are some technical info links that I’ve posted before:
https://gist.github.com/woachk/2f86755260f2fee1baf71c90cd6533e9
https://security.googleblog.com/2018/01/more-details-about-mitigations-for-cpu_4.html
https://github.com/marcan/speculation-bugs
https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf (links to pdf)
2 users thanked author for this post.
-
-
-
-
From that article:
If the problem were just that it enabled the derandomization of ASLR, this probably wouldn’t be a huge disaster. ASLR is a nice protection, but it’s known to be imperfect. It’s meant to be a hurdle for attackers, not an impenetrable barrier. The industry reaction—a fairly major change to both Windows and Linux, developed with some secrecy—suggests that it’s not just ASLR that’s defeated and that a more general ability to leak information from the kernel has been developed. Indeed, researchers have started to tweet that they’re able to leak and read arbitrary kernel data. Another possibility is that the flaw can be used to escape out of a virtual machine and compromise a hypervisor.
The solution that both the Windows and Linux developers have picked is substantially the same, and derived from that KAISER work: the kernel page table entries are no longer shared with each process. In Linux, this is called Kernel Page Table Isolation (KPTI).
With the patches, the memory address is still split in two; it’s just the kernel half is almost empty. It’s not quite empty, because a few kernel pieces need to be mapped permanently, whether the processor is running in ring 3 or ring 0, but it’s close to empty. This means that even if a malicious user program tries to probe kernel memory and leak information, it will fail—there’s simply nothing to leak. The real kernel page tables are only used when the kernel itself is running.
This undermines the very reason for the split address space in the first place. The TLB now needs to clear out any entries related to the real kernel page tables every time it switches to a user program, putting an end to the performance saving that splitting enabled.
The impact of this will vary depending on the workload. Every time a program makes a call into the kernel—to read from disk, to send data to the network, to open a file, and so on—that call will be a little more expensive, since it will force the TLB to be flushed and the real kernel page table to be loaded. Programs that don’t use the kernel much might see a hit of perhaps 2-3 percent—there’s still some overhead because the kernel always has to run occasionally, to handle things like multitasking.
But workloads that call into the kernel a ton will see much greater performance drop off. In a benchmark, a program that does virtually nothing other than call into the kernel saw its performance drop by about 50 percent; in other words, each call into the kernel took twice as long with the patch than it did without. Benchmarks that use Linux’s loopback networking also see a big hit, such as 17 percent in this Postgres benchmark. Real database workloads using real networking should see lower impact, because with real networks, the overhead of calling into the kernel tends to be dominated by the overhead of using the actual network.
A potential 50% dropoff to protect against something whose chances of ever affecting me are extremely low? At this time, this is an unacceptable risk. What programs would use the kernel enough to cause this kind of performance hit? Gaming? Video encoding? Gaming + recording on the same machine simultaneously? I did notice on reddit (don’t remember where I saw the link on here) of a gamer that did some of these tests and saw significant performance drop offs in some areas that affected gameplay performance. Obviously, recording smooth gameplay videos is also potentially out of the question.
It’s just not acceptable especially to mitigate a risk that is highly unlikely to ever affect me. If I did happen to be exposed to it, I have blacklists and I have uBlock and uMatrix blocking all webpage elements that are not first party by default as well as any ads and malicious content. I may even switch over to Pale Moon if I can work out a few little things for even more protection in the browser.
I just refuse to panic myself into a “solution” to a problem that is going to cause problems worse than the initial problem the solution was made to fix. Sacrificing as much as half of your engine power to fix a small leak in the boat is not a solution. It’s replacing one problem with another.
People who use their systems for more mundane tasks probably have nothing to worry about, though. For me, I spent money on this PC for the performance and am not willing to give any of it up for “security reasons” nor should I or anyone else have to be faced with such a dilemma. It needs to be better.
4 users thanked author for this post.
-
-
I’m a dyed-in-the-wool lifetime geek and I’ve got to tell you even the tl;dr sections of the techical descriptions have caused my eyes to start to glaze over…
So far I’m not impressed by what I’m reading and will not yet be (potentially badly) hobbling my pre-Haswell systems to protect against a risk I can’t even begin to quantify yet.
-Noel
4 users thanked author for this post.
-
-
-
-
-
-
-
-
-
-
-
Soooooooo what does this mean? Does the Windows Updater check to see if the user’s computer has an AMD or Intel chip?
I have an Intel Core i7-2600K chip and Norton (which has delivered the necessary registry entry). I had, and as of a re-check now, still have the KB4056894 with check mark.
Am I still good to install? Or, is the KB being pulled for everyone to be replaced with a KB usable by everyone?
1 user thanked author for this post.
-
Microsoft yanks all of this month’s Windows patches for “devices with impacted AMD processors”
= For M$ to be able to do this, it means whenever M$ use Windows Update Service to scan the computers, M$ know which processors they are running.
Wonder what other computer data that M$ may be scooping up with Windows Update, besides which AV programs are running. In theory, M$ can scoop up every data that is on your Windows computer with Windows Update. Can you trust M$?
So far, we know that M$ scan for data about your hardware and software configuration, eg your Windows license is deactivated if you change the motherboard, or your Win 7/8.1 computers can no longer receive security updates from M$ if you are running Kabylake/Ryzen processors, or your computer may be bricked by M$ if you are running pirated Windows.
1 user thanked author for this post.
-
Read the Microsoft privacy policy. I explains what information is collected through Windows Update.
1 user thanked author for this post.
-
-
-
-
-
Günter Born has published a list of those AMD CPUs that he’s seen reported: https://borncity.com/win/2018/01/08/windows10-update-kb4056892-kills-amd-systems-error-0x800f0845/
Browsing German forums, I found that only AMD CPUs are affected. Here is a list of AMD processors mentioned:
AMD Athlon 64 X2
Athlon 64 X2 4200+
AMD Athlon ™ 64 3800+
AMD Athlon 64×2 Dual Core 4400+
AMD Athlon Dual Core 4850e
AMD 4850e
AMD-Athlon 64×2 5200+
HexaCore AMD Phenom II X6 Black Edition 1090T
DualCore AMD Athlon 64 X2, 2000 MHz (10 x 200) 3800+
AMD Athlon(tm) 64 X2 Dual Core Processor 6000+I’ve also seen Semprons mentioned a couple of times.
1 user thanked author for this post.
-
-
-
-
-
“Halt” would be proper description
-
-
-
-
-
how one can test?
If you do video encoding – do the same before and after the patch, then compare encoding time.
Other things to do is benchmarking – PC Mark (overall), 3D Mark (gaming), SiSoft Sandra, Cinebench and others…
Fractal Design Pop Air * Thermaltake Toughpower GF3 750W * ASUS TUF GAMING B560M-PLUS * Intel Core i9-11900K * 4 x 8 GB G.Skill Aegis DDR4 3600 MHz CL16 * ASRock RX 6800 XT Phantom Gaming 16GB OC * XPG GAMMIX S70 BLADE 1TB * SanDisk Ultra 3D 1TB * Samsung EVO 840 250GB * DVD RW Lite-ON iHAS 124 * Windows 10 Pro 22H2 64-bit Insider * Windows 11 Pro Beta Insider1 user thanked author for this post.
-
-
-
-
-
What is troubling about the Monthly Rollup is that when a component of the update fails after installation, it is no longer possible to locate what element caused system crash. If the chip patch is bundled with several other patches today and if there are system failures, there will be problems determining exactly which patch causes failure.
The Monthly Rollup issue is not new. However, the difficulties in one giant patch (as opposed to numerous small ones) are highlighted with the obvious failure of the early chip patch.
On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender3 users thanked author for this post.
-
Has anyone to date doucmented how, in technical terms, these patches mitigate the vulnerabilities? Do they rewrite the microcode so that processors stop doing speculative execution? Do they change the browsers so that they can’t be compromised via Javascript? Do they make the kernel zero out buffers when they’re deallocated? What we have is wording like this (from the KB4056894 page for Win 7 / Server 2008):
This security update includes improvements and fixes that were a part of update KB4054518 (released December 12, 2017) and addresses the following issues:
- Security updates to Windows SMB Server, Windows Kernel, Microsoft Graphics Component, Internet Explorer, and Windows Graphics.
And this (KB4056895 for Win 8.1, Server 2012):
This security update includes improvements and fixes that were a part of update KB4054519 (released December 12, 2017) and addresses the following issues:
- Security updates to Windows Kernel, Windows Datacenter Networking, Windows Graphics, and Internet Explorer.
Wouldn’t it be nice to know more about what’s technically being done to our computing environments so that we could understand the risks? Not only are there gotchas built into the cumulative “all or nothing” path, but there are also ramifications of the policy changes at Microsoft toward reducing technical documentation to “we fixed, it, trust us.” -Noel
4 users thanked author for this post.
-
-
I have an AMD Athlon desktop with an ATI RS690C chipset. It is not on any list that I have seen. Considering its age and the fact that it meets the computing needs of a certain family member right now, I will not be installing any patches from Microsoft on this system that is supposed to address the meltdown vulnerability. What is it that Microsoft did not understand when AMD stated that all their processors are not affected by meltdown.
Having chosen Group B allows me this flexibility. I was expecting the meltdown patch was going to be a standalone patch considering it is a kernel update and released out of band. Unfortunately, MS bundled it with other patches, [messing] both Group A and Group B.
Spectre is going to present us all with the same dilemma. AMD says their processors are affected by Spectre, but just slightly. I take that as meaning ‘a little bit pregnant’. It seems that a BIOS update will be required, but not made available to older processors (>5 years) – just wondering if MS will impose this condition … NO MORE SECURITY UPDATES FOR SYSTEMS THAT DO NOT HAVE THIS BIOS UPDATE INSTALLED – EVER!!!!
2 users thanked author for this post.
-
-
-
The National Vulnerability Database gives each of the three speculative execution vulns a CVSS v3 severity base score of 5.6 on a scale of 10, with impact scores of 4.0 and exploitability scores of 1.1 on a scale of 10:
5 users thanked author for this post.
-
I have a question that I think may be relevent to others that, like me, want to remain safe but are very skittish about the microcode and windows fixes (or have a more than 5-year old processor), and are very confident that all installed apps are not malicious. It seems that for people in this situation, the entry point for Meltdown and Spectre exploits boils down to the web browser. Everything I’ve read seems to indicate that the way this can happen is through Javascript. So, is a potential way to remain safe while not slowing down your computer simply by disabling Javascript? Or are there other ways outside of Javascript that a browser can be vulnerable? I’m thinking of installing extensions such as ScriptSafe or NoScript; I do understand that there would be a learning curve as I whitelist trusted sites that require JS. But I wouldn’t bother with these extensions if JS is not the only way that Meltdown and Spectre can do harm.
1 user thanked author for this post.
-
Installing an ad blocker would be a good idea.
If you disable JavaScript globally, a lot of websites won’t work properly. If you can handle script blocking with NoScript or similar, that would be a good thing to do also.
5 users thanked author for this post.
-
Indeed!
For the Windows boxes under my care, Firefox is the browser of choice (either the mainstream release or ESR), running uBlock Origin and NoScript, together with HTTPS Everywhere and the Privacy Badger (both from the EFF).
It is recommended to allow only those scripts necessary to obtain the desired access, and then only temporarily (that is, for that session).
-
-
I was remiss in not mentioning a rather nifty – and very useful – feature of NoScript: if one hovers over a detected script, holds down the shift button and then clicks on the Temporarily allow option (which will not enable the script), then a new window will open with evaluations of that script from several reputable sites; the bottom option, URLVoid Scan, itself runs the site associated with that script through thirty-four malware engines, or so. A little extra effort up front can spare a great deal of aggravation later on… .
5 users thanked author for this post.
-
-
-
With NoScript run it out of the box, click on the icon and just temporarily allow scripts you trust on trusted sites. That is it, if you allow permanently it will allow permanently those unwanted domains on other sites. This will help you a great deal and I would recommend it anyway.
Is it the only way you can be exploited (through Javascript)? No. Thats why there is a global panic right now. Bottom line, these exploits are hard to pull off, and as far as we know, not in the wild yet. Javascript would be the easy option with ads probably…
What to do? Wait. Keep your browsers up to date, install NoScript and practice normal safe routines. Let the patches have time to mature. It’s probably not time to panic – and millions will never even know, let alone be able to apply these patches. They won’t know, or their computers won’t get them for some reason.
None of us knows, really. Normal users are probably not the juicy targets. The big boys will have to apply all patches, and that may be why there is a lot of panic online. (Cloud providers, institutions, and so on – but we need them to do that for security reasons and they need to do that for security/legal reasons).
I have a question for anyone who knows: What happens when you update the kernel in a VM? (a: can the exploit overcome the virtual environment?, b: Your guest does rely/call on its host at the host kernel level?) (Or wouldn’t that matter?). We all are wondering about these things and they are hard to wrap your head around, that’s for sure.
-
-
-
-
-
-
-
Think I should probably be glad my old computer died on me late last year, then… It was nearly 7 years old with an AMD processor running Win7. With my luck, I’d have been SOL
-
-
-
I’d leave it as is.
1 user thanked author for this post.
-
-
-
1 user thanked author for this post.
-
-
-
Here’s an interesting wrinkle. I have both Panda Antivirus and Malwarebytes Anti-Malware installed. (This was not initially by choice…I’d paid for just MWB Anti-Exploit, and the company decided to roll that into a combined product for the same yearly price. It’s billed as being designed to work alongside traditional antivirus, and has always played nicely with Panda in the past, so I continue to run both.)
I noticed the other day, however, that I had been offered KB4056894 in Windows Update, despite the fact that Mr. Beaumont’s spreadsheet, and the documentation to which it linked, stated that Panda had not been certified compatible or updated yet to set the registry entry.
Going back to check the spreadsheet again, though, sure enough…Malwarebytes does. So I have to assume it went ahead and set the key, triggering Windows Update to offer me the patch despite the fact that I still have an antivirus product that isn’t verified as compatible.
Users with layered security solutions should go over that list very carefully before assuming that seeing the patch in Windows Update means it’s safe to install it.
1 user thanked author for this post.
-
-
-
-
-
Interesting, my generic PC with NVIDIA graphics did not receive the Meltdown-Spectre roll-up patch when I installed my January patch Tuesday. My other PCs with NON-NVIDIA, NON-AMD graphics received to roll-up patches. Just wondering if MS checks to see if there is an NVIDIA graphics card along with an AMD graphics card and holds back the patch. I was not aware of any NVIDIA issues with the patch. Anyone else noticed this?
1 user thanked author for this post.
-
I just visited my OEM support site to see if there is a BIOS update for Spectre available. Many products already have code available, however neither my laptop or desktop is listed. Both are Intel based and therefore affected. Looks as though the 5 year cutoff date announced by Intel is being adopted by my OEM.
The support forum is currently being besieged by some very angry customers. I can not see some of these customers embracing this OEM or Intel in the future.
So far it looks as though an unsupported system (for the Spectre BIOS update) will have been acquired before January 2013, no matter its processor gen type.
1 user thanked author for this post.
-
-
-
-
-
-
While KB4056894 was previously unchecked on my AMD machine and then pulled yesterday, today it’s offered again and this time it’s checked.
As before, it’s offered checked on my Intel machine (which has an AMD Radeon card).
No action intended yet, of course.
1 user thanked author for this post.
-
-
-
Viewing 39 reply threads - This topic has 80 replies, 30 voices, and was last updated 4 years, 8 months ago by
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Notice on termination of services of LG Mobile Phone Software Updates
by 4 hours, 13 minutes ago
-
Update your Apple Devices Wormable Zero-Click Remote Code Execution in AirPlay..
by 14 minutes ago
-
Amazon denies it had plans to be clear about consumer tariff costs
by 6 hours, 39 minutes ago
-
Return of the brain dead FF sidebar
by 3 hours, 13 minutes ago
-
windows settings managed by your organization
by 1 hour, 21 minutes ago
-
Securing Laptop for Trustee Administrattor
by 1 hour, 33 minutes ago
-
The local account tax
by 1 hour, 19 minutes ago
-
Recall is back with KB5055627(OS Build 26100.3915) Preview
by 13 hours, 15 minutes ago
-
Digital TV Antenna Recommendation
by 5 hours, 47 minutes ago
-
Server 2019 Domain Controllers broken by updates
by 1 day, 1 hour ago
-
Google won’t remove 3rd party cookies in Chrome as promised
by 1 day, 2 hours ago
-
Microsoft Manager Says macOS Is Better Than Windows 11
by 1 day, 5 hours ago
-
Outlook (NEW) Getting really Pushy
by 8 hours, 24 minutes ago
-
Steps to take before updating to 24H2
by 10 minutes ago
-
Which Web browser is the most secure for 2025?
by 12 hours, 51 minutes ago
-
Replacing Skype
by 1 hour, 24 minutes ago
-
FileOptimizer — Over 90 tools working together to squish your files
by 23 hours, 50 minutes ago
-
Excel Macro — ask for filename to be saved
by 1 day, 8 hours ago
-
Trying to backup Win 10 computer to iCloud
by 1 hour, 10 minutes ago
-
Windows 11 Insider Preview build 26200.5570 released to DEV
by 3 days, 5 hours ago
-
Windows 11 Insider Preview build 26120.3941 (24H2) released to BETA
by 3 days, 7 hours ago
-
Windows 11 Insider Preview Build 22635.5305 (23H2) released to BETA
by 3 days, 7 hours ago
-
No April cumulative update for Win 11 23H2?
by 1 day, 19 hours ago
-
AugLoop.All (TEST Augmentation Loop MSIT)
by 3 days, 8 hours ago
-
Boot Sequence for Dell Optiplex 7070 Tower
by 3 days, 23 hours ago
-
OTT Upgrade Windows 11 to 24H2 on Unsupported Hardware
by 4 days, 2 hours ago
-
Inetpub can be tricked
by 2 days, 10 hours ago
-
How merge Outlook 2016 .pst file w/into newly created Outlook 2024 install .pst?
by 2 days, 20 hours ago
-
FBI 2024 Internet Crime Report
by 4 days, 6 hours ago
-
Perplexity CEO says its browser will track everything users do online
by 1 day, 15 hours ago
Remembering Woody
