Windows / MacOS fixes for Meltdown and Spectre (Intel kernel flaws) (1 Viewer)

[Dennis Nicholls]

There's a bug found in the Intel processors that permits non-privileged programs access to kernel memory.

https://www.pcworld.com/article/324...cpu-kernel-bug-faq-how-it-affects-pc-mac.html

https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/

This is a HW issue and cannot be fixed in microcode. Apparently Linux, Windows, and MacOS are being patched as we speak to address this serious security issue.

 

[Dennis Nicholls]

Intel comments on the bug.
https://www.pcworld.com/article/324...ors/intel-responds-to-the-cpu-kernel-bug.html

Intel claims that it DOES affect AMD and ARM processors too.

 

[Dennis Nicholls]

Microsoft issues emergency Win10 patch TODAY.
https://www.theverge.com/2018/1/3/16846784/microsoft-processor-bug-windows-10-fix

 

[Chris Strnad]

https://arstechnica.com/gadgets/201...odern-processor-has-unfixable-security-flaws/
https://spectreattack.com/

TL;DR: keep your computing devices up-to-date, stay away from dodgy websites, be *very* circumspect about email (& attachments) and what you install, and use a reasonable anti-virus program (reasonable free options: bitdefender/avira for PC, lookout for mobile.)

 

[Dennis Nicholls]

OK so the news media has settled on two names for this issue: Meltdown and Spectre.

I've installed the MS patch KB4056892 on my two Win10 machines. Performance on browsing and office tasks didn't take a noticeable hit but now a full scan with an antivirus takes twice as long.

 

[Dennis Nicholls]

I'm hoping that that MS patch was a rush job, and that subsequent ones may produce less of a performance hit.

 

[Dennis Nicholls]

The HP marketing group is probably kicking themselves now for branding their laptop line as "Spectre".

http://store.hp.com/us/en/mdp/spectre-355002--1#!&tab=vao

 

[Dennis Nicholls]

Today's news is that Microsoft's patch for AMD systems makes them unbootable.

IMPORTANT

https://www.theverge.com/2018/1/9/1...tdown-spectre-security-updates-amd-pcs-issues

 

[Stan]

https://arstechnica.com/gadgets/201...odern-processor-has-unfixable-security-flaws/
https://spectreattack.com/

TL;DR: keep your computing devices up-to-date, stay away from dodgy websites, be *very* circumspect about email (& attachments) and what you install, and use a reasonable anti-virus program (reasonable free options: bitdefender/avira for PC, lookout for mobile.)

Definitely keep things up to date, new dangers appear every day.

As a slight add-on to this thread, 25+ years of network admin and still no way around stupid users. Things I wanted to do to lock down the systems were over-ridden by higher up management twits. Luckily most of the 250 employees I supported were fairly intelligent and not to many issues.

The worst was oddly from the "higher ups", the VPs, etc., Many broke all the rules, figured they were magically exempt. Had one guy who installed a game for his kid to play, totally hosed his video display. Once I finally pried out of him what he had done, a quick uninstall and things were fine. Luckily not a virus, only affected him.

Pure coincidence, but I went into the hospital to have my appendix removed, kind of an emergency operation. I had just hired a consultant to work with us to make the network more secure. Within hours we're invaded by a virus, thankfully only affected PCs, not the servers. I ended up in the hospital so couldn't help. Everything was eventually cleared up, no permanent damage. To this day, I'd swear this guy infected us just to show how "brilliant" he was at removing viruses. Couldn't prove any of it since I was in the hospital for several days, but very interesting timing.

 

[Dennis Nicholls]

MS put out a voluntary update KB4058258 a few days ago. Today it got bumped onto the automatic update pile, and my two machines got it. IIUC it's to undo some of the damage of the 3 January update KB4056892.

When it downloads it later re-installs KB4056892. I wonder what that's all about.

This has been a heck of a month for patches.

https://www.computerworld.com/artic...-win10-1709-cumulative-update-kb-4058258.html

 

[Dennis Nicholls]

Intel's processor patch page shows that my Sandy Bridge i5 now has a production patch. My Wolfdale Core2 is still stuck in planning status.

https://newsroom.intel.com/wp-content/uploads/sites/11/2018/03/microcode-update-guidance.pdf

I probably lucked out since my Wolfdale is about as old as they even mention in this chart. Wolfdale is a die shrink of Conroe which does not appear on the list.

 

[Dennis Nicholls]

Rats. Intel now has stated that a bunch of older processors, including my Core 2 Duo (Wolfdale) will NOT receive microcode updates. The work process status has been changed to STOPPED.

https://newsroom.intel.com/wp-content/uploads/sites/11/2018/04/microcode-update-guidance.pdf

At least I've already installed the Dell BIOS update for my laptop (Sandy Bridge).

 

[Clinton McClure]

I’ve been dealing with this at work. Good times.

 

[Dennis Nicholls]

This was the last straw for my Inspiron 560 w/ Wolfdale. The old processor has been struggling to keep up and now condemned to oblivion.

So I ordered another refurb, this time a desktop Optiplex 3010 with Ivy Bridge i5. Dell already has a BIOS update for it. I don't trust anything that isn't already available.

Yuch. I hate transferring all my old stuff to a new machine.

 

[Dennis Nicholls]

Today's Windows Update contained Intel patches against Spectre 2 variant dating as far back as Sandy Bridge.