Microsoft Issues Rare Out-of-Band Emergency Windows Update For Processor Security Bugs (theverge.com) 129
An anonymous reader shares a report: Microsoft is issuing a rare out-of-band security update to supported versions of Windows today (Wednesday). The software update is part of a number of fixes that will protect against a newly-discovered processor bug in Intel, AMD, and ARM chipsets. Sources familiar with Microsoft's plans tell The Verge that the company will issue a Windows update that will be automatically applied to Windows 10 machines at 5PM ET / 2PM PT today. The update will also be available for older and supported versions of Windows today, but systems running operating systems like Windows 7 or Windows 8 won't automatically be updated through Windows Update until next Tuesday. Windows 10 will be automatically updated today.
Re: (Score:3)
Re: (Score:2)
Also no speedup, so, meh.
Re: (Score:3)
There is KB4012982, which is an update that detects newer CPU, and disables futher updates.
https://support.microsoft.com/... [microsoft.com]
The workaround for that is quite simple, uninstall and block that update, and you can continue to patch...
Re: (Score:2)
Unpatched Win7 running on Atom? Can it get slower?
Re: (Score:3)
Re: (Score:3)
Unpatched win7 running on Ryzen.... what slowdown?
Luckily for us Windows 7 users Microsoft has chosen Windows 10 as the guinea pig. We'll get to see what happens performance-wise before we choose to update (or not).
Should be user-configurable or based on trust (Score:5, Interesting)
Re: (Score:1)
Re: (Score:2)
Yeah, of course it's much better to just apply the fix and *then* find out your performance has gone to shit.
Luckily for us Windows 7 users, Microsoft has chosen Windows 10 as the guinea pigs.
Re: (Score:2)
There is very strong evidence that (for example) applications which do a lot of I/O, like databases, will have a measurable hit.
Actually we're past that, we're now at:
There is empirical data that applications that do a lot of Kernel calls (such as disk I/O like databases) will see a large impact.
Can't risk sanctity of kernel-enforced DRM (Score:5, Interesting)
Since the most likely result of the vulnerability to desktop users is being able to defeat kernel-enforced DRM and Windows licensing, it's no surprise Microsoft would push this out as a mandatory update of the highest priority.
Re: (Score:2)
When has Microsoft ever provided kernel level security bypasses?
Re: (Score:2)
Good idea. I took this as a cue to download the latest rollups. With one exception, my Win7 machines are offline, so they don't need to be "fixed".
I'll still keep my old downloads, though. Microsoft has already been caught updating old KB updates without issuing notices or new version numbers, so I wouldn't be surprised if anything DRM related is applied retroactively to the existing downloads.
Re: Can't risk sanctity of kernel-enforced DRM (Score:2)
Apple: probably has the same priorities & agenda as Microsoft insofar as DRM and "trusted" computing is concerned. And Apple's culture tends towards "make decisions for users".
Linux: users are free to disable the patch if they'd rather have better performance.
Re: (Score:2)
They probably did it because it's a flaw and at their tempo, it wasn't out of band...
Re: (Score:2)
Re: (Score:2)
Oh, yeah all that hypervisor stuff, where a VM running this malware can obtain the
Re: (Score:2)
Wow! See, now that's the kind of detail we need in these articles. I had NO IDEA this could be exploited from Java Script.
And yet it's the old Sun Java sandbox that was too insecure to survive and "addons" and "extensions" that are the security problem in modern web browsers. Right.
Which browser? Or are you claiming Chrome, Internet Explorer, and Firefox all fell down on this one?
AMD getting the Patch despite not being vulnerable (Score:4, Insightful)
Re: (Score:1)
Re: (Score:1)
There are two kinds of vulnerabilities: One which allows reads across privilege boundaries. Page table isolation prevents reads of kernel memory from user mode and is needed to mitigate this vulnerability, which has only been shown on Intel processors. The other vulnerability does not cross privilege boundaries and is thus not mitigated by PTI. The performance penalty resulting from PTI is unnecessary on AMD processors.
Re: (Score:2)
Correct.
But as GP noted, this is likely for ease of code mgt on MS's part.
Re: (Score:2)
Isn't that James Bond's problem?
Re: (Score:2)
I was waiting for this.
Re: (Score:2)
Re: (Score:2)
I believe that's true of the Linux patch. Do you have any reason to believe it's true of the MSWind patch?
Re: (Score:2)
Seems like an unnecessary performance penalty to push on AMD users. Most likely down for simplicity/consistency on Microsoft's side for kernel code management.
Doesn't seem to have any impact at all on my AMD machine, though I'm seeing around a 5-13% drop in performance with my Intel machine. Both are running the current version of Win10, I'm sure there's going to be a lot of screeching on gaming forums later today when people suddenly start having serious performance issues, especially since Intel holds around 80-90% of the gaming marketshare according to steam. [steampowered.com] My development machine that's in slow ring right now hasn't seen a patch pushed out yet, probably wo
Re: (Score:2)
Yeah and ignore that impact bit. Since it appears that it was a force nvidia driver update, that decided to install itself despite telling it never to update the driver. What a fucking shitshow on that one.
Re: (Score:2)
Re: (Score:2)
Windows Embedded Standard 2009: Extended Support will end on Jan. 8, 2019.
Windows Embedded POSReady 2009: Extended support will end on April 9, 2019.
https://blogs.msdn.microsoft.c... [microsoft.com]
Re: (Score:2)
Which means a lot of ATMs out there. Maybe a few voting machines too? Could be fun at the mid term election in the US.
Comment removed (Score:5, Insightful)
Re: (Score:3, Informative)
Read more than the headlines.
There are two bugs. Some articles have reported that one of the bugs is Intel-specific, and one of them is not (Intel, AMD, and ARM). Whether the necessary patches will carry the same performance hit for each is not yet clear from what I've been reading, but it looks like the latter one might be less serious.
Re: (Score:1)
There is no fix for either of the bugs. Page Table Isolation (PTI) mitigates the bug that allows kernel memory to be read from user mode, which has only been shown on Intel CPUs. That's the one with the reported slowdowns up to 30% depending on the type of workload (basically how much it uses syscalls).
The other bug is present in all modern CPUs and the only way around it is to prevent certain code patterns from being run. This will require modifications to JIT compilers, mostly, because that's how untruste
Re: (Score:2)
Read more than the headlines.
There are two bugs. Some articles have reported that one of the bugs is Intel-specific, and one of them is not (Intel, AMD, and ARM). Whether the necessary patches will carry the same performance hit for each is not yet clear from what I've been reading, but it looks like the latter one might be less serious.
Spectre cannot be patched, but it cannot be exploited, either (as far as we know).
Meltdown, meanwhile, is seriously dangerous because it is very easy to use, even with just a malicious webpage!
Re: (Score:1)
You should be more careful with "cannot be exploited" comments. All three bugs have been exploited on actual hardware. You might think that a process reading some of its own memory through a convoluted exploit of a CPU behavior isn't a problem. But we run untrusted code all the time. We allow it, because we assume that it cannot read all in-process memory. That's what Javascript in a web browser is. Your browser holds secrets in memory that must be kept hidden from scripts. If a script is translated into ma
Re:What? (Score:4, Informative)
That's what comes from just barely reading the headlines. There are 2 classes of bugs (Spectre, Meltdown) and 3 exploits (Spectre-1, Spectre-2, and Meltdown-1). AMD and ARM are resistant to only to Meltdown. They are susceptible to Spectre.
Meltdown goes back to Core2, Spectre goes back down to Pentium Pro. Many other processors are likely vulnerable to Spectre, any CPU that does speculative execution may be vulnerable. Mainframes have been doing this since the 60's IIRC.
Re:What? (Score:5, Informative)
There seem to be Intel sockpuppets flooding technical forums, making the false equivalence between Meltdown (affects only Intel) and Spectre (affects all CPUs), whereas Meltdown is a clearly exploitable and in fact the exploit was demonstrated in a fucking browser running a Javascript. There is no known way to exploit Spectre. Spectre does not cross userspace-kernelspace.
Re: (Score:2)
This was yesterday! (Score:2, Informative)
Re: (Score:2)
Re: (Score:2)
Thursday is Wednesday. Thursday has always been Wednesday. Thursday will always be Wednesday.
Odd. I must have missed that when I read 1984.
Re: (Score:2)
Did you get a chance to do any benchmarking? (Score:2)
Re: (Score:2)
Re: (Score:2)
If it hits Virtualization but not gaming expect to see a ton of cheap CPUs on ebay as companies are forced to dump them. If that happens I can probably get back to square one for about $300 bucks by upgrading my i5s to i7s.
Damn you, Microsoft! (Score:2)
I was planning on playing games at exactly 17:00 EST today! My gaming session is totally ruuinned! /Stewie
Re: (Score:2)
Performance hit? (Score:2)
Anyone care to comment on the performance hit after the patch? Is it obvious, measureable?
Re: Performance hit? (Score:1)
Win10 Ent 1709, i5 4cores 2.6GHz. You can feel it. Tasks that usually reported 0-0.1% now show 1-4%. Before average CPU consumption was below 10% now varies between 20 and 40%.
Subjective perception of the system performance is better than numbers show, but noticeable.
Some links from Microsoft (Score:2)
https://support.microsoft.com/... [microsoft.com]
https://support.microsoft.com/... [microsoft.com]
https://support.microsoft.com/... [microsoft.com]
https://portal.msrc.microsoft.... [microsoft.com]
https://docs.microsoft.com/en-... [microsoft.com]
https://www.powershellgallery.... [powershellgallery.com]
Doesn't help me a bit (Score:2)
Re: (Score:1)
At the very least you should have been able to download the latest version 1703, burn the iso or make a bootable stick and reinstall, while keeping all apps and settings. It generally works, I've been updating this way for years
It still doesn't explain you you even got to this weird position where nothing works update-wise and it is the first time I hear of such a serious disability.
Is it a brand name laptop like dell or HP perhaps, where OS updating only works through their own specialized application?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Have you tried Sysnative.com? I had a serious and convoluted f-up with Windows Update, made worse no doubt by trying various incantations posted around the net by people who really don't know what they're talking about. The folks at Sysnative basically assign you a case worker who gives you things to try and troubleshooting procedures to report back, in a systematic manner. I was incredulous when, after a long and complicated exchange of procedures, the darn thing worked! And for free! (I sent them a few bu
Not in the UK yet... (Score:3)
I have run Windows Update several times today, but five minutes ago it was still telling me that there are no updates for my computer. (Windows 7 SP1, i7-940).
And I am running MSE, not any "third party" anti-virus.
This is normal behaviour. For many years Windows updates have not appeared here in the UK until at least 24 hours after the USA.
Re: (Score:2)
Apologies. After posting the parent I went back and read the last line of TFA.
Apparently, those of us running Windows 7 in the UK are now second-class citizens in two different ways: geography and version.
Re: (Score:2)
I got nothing in my old 64-bit W7 HPE SP1 Intel desktop PC.
Re: (Score:2)
Are you running a non-Microsoft AV package? If so you might need to install the appropriate update for it.
Re: (Score:2)
I have its internal Defender (got its daily updates from WU), SAS, & MBAM.
Re: (Score:2)
All done now. When I started my PC this morning Windows Update offered me the patch, and installed it quickly.
Broken sandbox patch? Give me a break! (Score:2)
Seriously, this is an escalation flaw on Windows and it's a "priority patch"?!!!
I don't really care how many processors the "same bug" might affect, how can any version of Windows come close to saying that the most humble executable can't own the whole system if written correctly?
Linux can't say this, Apple can't say this, OpenBSD won't even try to say this and yet suddenly plugging one such hole in Windows requires an out of band patch that also trashes performance? What, did someone's digital restriction
Re: (Score:2)
I don't think you get it.
Every OS has holes in this area, many of them known and unpatched for years. Why is this layer that won't be secure after the patch anyway suddenly important?
Re: (Score:2)
I don't know why I'm bothering to respond to anonymous cowards but...
This is a patch for a privilege escalation attack [wikipedia.org] on Microsoft Windows.
From the article:
There appears to be a flaw in modern processors that let attackers bypass kernel access protections so that regular apps can read the contents of kernel memory.
So, yes it's a processor flaw, but the only problem is that some application processes may get to read some kernel memory that they aren't supposed to read. That's the very definition of privilege escalation, and not even total privilege escalation, just being able to take one more privilege than normal temporarily.
This is a Microsoft Windows patch.
To Upgrade or Not To Upgrade (Score:1)
Re: (Score:2)
Porn sites want to give you more porn.
It is the Governments you have to worry about.
Re: (Score:1)
Re: (Score:2)
You are sending much more information than my Linux box sends, which is NOTHING. More importantly, unless you are routinely port sniffing, you don't even know how much you are sending, and unless you can decrypt their spybot garbage, you have no idea WHAT you are sending either.
conspiracy hat time (Score:3)
Is it a coincidence that this flaw in CPUs since '96 has only been recently discovered and the article from a few days ago that top tech snoops are leaving the NSA?
Re: (Score:2)
Please elaborate. What's the link between the NSA snoops leaving, and this being discovered? Because I don't see it. Why would *anyone* leave a job at the NSA because of this discovery?
Per that other article, people are leaving the NSA because of sucky pay and management, obviously not because of this discovery. Then someone who was there and has been exploiting this problem for a while "discovers" it now that they're in the private sector primarily because they don't want to be snooped by their former colleagues.
why AMD and will this messup Xbox as well? (Score:2)
why AMD and will this messup Xbox as well?
Re: Mac OS X (Score:2, Informative)
Apple already deployed a fix in Mac OS X 10.12.3
Re: (Score:3)
Oh, sure. Leave all of us PowerPC Mac users in the dust...
Re: (Score:2)
You've been mired there for quite awhile.
Re: (Score:3)
OMG this affects PowerPC too! It's bigger than I thought!
Re: (Score:1)
I still have some 680x0 Macs.
Re: (Score:1)
10.13.2.
10.12.3 is still quite vulnerable, as is every Mac unable to run Sierra (any hardware prior to 2009).
Re: Mac OS X (Score:1)
While Microsoft can manage to patch an OS circa 2009, Apple couldnâ(TM)t be bothered to patch anything older than Sept 2017.
Re: Mac OS X (Score:1)
Dont look here then https://twitter.com/aionescu/status/948609809540046849
Confirmation bias (Score:2)
I'll not hold my breath waiting for Apple. They're getting worse and worse lately.
Don't let the fact that they've already addressed [9to5mac.com] the issue interfere with your anti Apple bias.
Re: (Score:2)
So Microsoft has out-of-band access to the CPUs of Windows users computers so that they can make updates to it? What in the world? Glad I don't use that operating system.
Indeed. MS has the ability to install, as root, changes to the OS on your computer (and presumably anything else on the HD).
That is the very definition of a Back Door.
This "out-of-band pushed hot-fix" only shows the fact in bright relief. Windows machines (on X86 at least) have been back-doored since 1995. Whether anyone put it there, or exploited it before the patch, is the unknown.
BTW, the last "out-of-band pushed update", the one about a month ago, between Thursday and Friday, played hell with my comp