Microsoft Pushes New Software-Based Spectre, Meltdown Mitigation Patches

Raevenlord · Mar 6, 2018

The Spectre/Meltdown road is long and pocked with lawsuits and security holes as it is, and Microsoft is one of the players that's trying to put the asphalt back to tip-top, Autobahn-worth shape. The company has already improved users' security to the Meltdown and Spectre exploits on its OS side; however, hardware patches, and specifically BIOS-editing ones are much harder to deploy and distribute by the PC chain. That may be one of the reasons why Microsoft is now again stepping up with software-based mitigations for Intel-based systems, specifically.

The new updates introduce a software-based CPU microcode revision update, and work at the OS-level to plug some security holes on your Intel processors that might otherwise remain unpatched. The reasons for them remaining unpatched can be many: either Intel taking even more time to deploy patches to the still vulnerable systems; your OEMs not deploying the Intel CPU microcode revisions via a BIOS update; or the good old "I forgot I could do it" user story. Of course, being software based means these Microsoft patches will have to be reapplied should users format their Windows system. The update can for now only be manually downloaded and installed, and can only be applied to version 1709 (Fall Creators Update) and Windows Server version 1709 (Server Core), but that's definitely better than the alternative of forcing less knowledgeable users to try and find their way through BIOS updates. Of course, that is assuming OEMs will ever push BIOS updates to their products.

View at TechPowerUp Main Site

CrAsHnBuRnXp · Mar 6, 2018

I still could care less about this.

eidairaman1 · Mar 6, 2018

CrAsHnBuRnXp said:
I still could care less about this.

You shouldn't care at all then, because apparently you do care lol.

CrAsHnBuRnXp · Mar 6, 2018

eidairaman1 said:
You shouldn't care at all then, because apparently you do care lol.

Nah. Just tired of seeing this shit already.

R-T-B · Mar 6, 2018

CrAsHnBuRnXp said:
Nah. Just tired of seeing this shit already.

It's an industry issue. Don't like? Don't click.

phanbuey · Mar 6, 2018

im wondering if the performance is better here than the bios one.

It would be cool if they let you choose the apps that it applied to... that way my sql box wouldnt take a hit running sql server, but chrome would.

Patriot · Mar 6, 2018

phanbuey said:
im wondering if the performance is better here than the bios one.

It would be cool if they let you choose the apps that it applied to... that way my sql box wouldnt take a hit running sql server, but chrome would.

In linux for spectre retropline (software fix) is the preferred solution, microcode solution takes a small performance hit, retropline does not.

R-T-B · Mar 7, 2018

Patriot said:
In linux for spectre retropline (software fix) is the preferred solution, microcode solution takes a small performance hit, retropline does not.

AFAIK both are needed for complete security.

And since this is literally the same microcode fix in a software package, performance will be identical.

Patriot · Mar 7, 2018

R-T-B said:
AFAIK both are needed for complete security.

And since this is literally the same microcode fix in a software package, performance will be identical.

Sigh... thought I specified amd... guess not.

Retpoline is a software workaround that mitigates against SV2 on platforms preceding Intel Skylake. This workaround does not require microcode in order to be active; however, it requires that code be recompiled with a compiler enabled with this feature. Recompiling the kernel with this feature is simple, but updating all of userspace is a significant effort, without which protection from speculative userspace attacks needs to rely on the slower hardware-based mitigations.

So yes Intel requires both microcode and retpoline for spectre, microcode for Spectre type 1, and retpoline for type 2, though because retpoline requires a recompile of all software a microcode update to cover part 2 is generally installed... and is slower than the retpoline solution.

https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown/TechFAQ#Retpoline
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown

https://www.amd.com/en/corporate/speculative-execution
AMD is not vulnerable to meltdown, has fixes out for type 1 spectre, isn't proven to be vulnerable to type 2, so retpoline covers it completely and they have optional microcodes for the paranoid.

Charts for linux patches are further confused because AMD64 is just 64bit kernel not AMD chips... yay.

rtwjunkie · Mar 7, 2018

I'm not sure how much I trust this fix from the people that just screwed up alot of USB connections, and then followed up with a fix that also has issues:
https://www.techpowerup.com/forums/...-of-usb-and-blue-screens.241831/#post-3808582

R-T-B · Mar 7, 2018

Patriot said:
isn't proven to be vulnerable to type 2,

Yes, it has been. Even the article you link admits that.

They also have yet to produce the optional microcode they promised. I've been looking hard for a very long time.

Patriot · Mar 7, 2018

R-T-B said:
Yes, it has been. Even the article you link admits that.

They also have yet to produce the optional microcode they promised. I've been looking hard for a very long time.

They changed the statement from near zero to I guess it could be but... It'd be hard.
The problem with a branch injection is the prediction engine is a nn ... it's learning and not exactly repeatable...which is needed for making exploits.

I have yet to see them specifically say that they found it vulnerable, just that they see its theoretically possible, but super hard.
I also have not seen anyone posting demonstration of it being vulnerable like I saw for type 1.

Optional microcode would be delivered to vendors, not individuals, also for type 2, type 1 microcode was delivered Jan 4th.
Why would vendors push microcode for type 2 if retpoline completely covers it... and it hasn't been demonstrated to be vulnerable.

But please... if you have a source showing that is truly vulnerable to type 2 please post it.
I am trying to keep updated on this cluster F but there is tons of miss information and contradictory information floating around.

https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html Heck even the research team only got type 1 working on amd hardware... but feel free to contradict them without proof.

CrAsHnBuRnXp · Mar 7, 2018

R-T-B said:
It's an industry issue. Don't like? Don't click.

It doesnt have to be rammed down our throats.

MS will release software patches that everyone will get. Yay i guess.

Intel will release patches to motherboard vendors to provide a bios update that anyone that has extensive knowledge will already know to do. Regular joe schmoe wont care let alone really even know and therefore wont update the BIOS.

ensabrenoir · Mar 7, 2018

.....sad day when you gotta decide which dose you the most harm......the ailment or the cure........

Prima.Vera · Mar 7, 2018

I care only for 1 thing. WHAT IS THE PERFORMANCE IMPACT???

TheGuruStud · Mar 7, 2018

Prima.Vera said:
I care only for 1 thing. WHAT IS THE PERFORMANCE IMPACT???

It makes their CPUs completely worthless in server if buying, but they're busy throwing shade and trying to convince everyone of the opposite.

Almost nothing for general consumers. Some prosumers may be hit.

evernessince · Mar 7, 2018

R-T-B said:
Yes, it has been. Even the article you link admits that.

They also have yet to produce the optional microcode they promised. I've been looking hard for a very long time.

I have not seen anyone able to exploit variant 2 on AMD hardware. You should provide links if you are going to contradict AMD engineers who weren't even able to exploit it.

cdawall · Mar 7, 2018

CrAsHnBuRnXp said:
It doesnt have to be rammed down our throats.

MS will release software patches that everyone will get. Yay i guess.

Intel will release patches to motherboard vendors to provide a bios update that anyone that has extensive knowledge will already know to do. Regular joe schmoe wont care let alone really even know and therefore wont update the BIOS.

Those bios patches are already being pushed by venders through windows update.

CrAsHnBuRnXp · Mar 7, 2018

cdawall said:
Those bios patches are already being pushed by venders through windows update.

I can see that going horribly wrong.

R-T-B · Mar 7, 2018

evernessince said:
I have not seen anyone able to exploit variant 2 on AMD hardware. You should provide links if you are going to contradict AMD engineers who weren't even able to exploit it.

I'm not contradicting them. They admit it is vulnerable, diffilculty is irrelevant to my point. This isn't a fanboy discussion so don't make it one.

Patriot said:
Optional microcode would be delivered to vendors, not individuals, also for type 2, type 1 microcode was delivered Jan 4th.
Why would vendors push microcode for type 2 if retpoline completely covers it... and it hasn't been demonstrated to be vulnerable.

Link or it didn't happen. I'm a bios modder and have been unable to trace any bios updates containing modified microcode fixes of any type. Yes, AMD said they were going to push some. I have yet to see that in any form.

CrAsHnBuRnXp said:
I can see that going horribly wrong.

No, not really. Microcode patches via Windows Update are simple and have been done in the past.

fullinfusion · Mar 7, 2018

and another reason I cant wait for Ryzen 2 to come out.

Patriot · Mar 7, 2018

R-T-B said:
I'm not contradicting them. They admit it is vulnerable, diffilculty is irrelevant to my point. This isn't a fanboy discussion so don't make it one.

Link or it didn't happen. I'm a bios modder and have been unable to trace any bios updates containing modified microcode fixes of any type. Yes, AMD said they were going to push some. I have yet to see that in any form.

No, not really. Microcode patches via Windows Update are simple and have been done in the past.

https://support.hpe.com/hpsc/swd/pu...c43761fa7c9f4ba1ac7a262002&swEnvOid=4184#tab4
Where I got the date from...I work on servers, so I am a tad server centric in my knowledge.

Epyc patches are at least out... but yeah not seeing consumer board updates.
I will ping Patrick @ STH and see if he can ask AMD directly.

cdawall · Mar 8, 2018

CrAsHnBuRnXp said:
I can see that going horribly wrong.

Windows 10 has been pushing firmware updates since it came out. Rarely have I ever seen an issue from it.

System Name	The Ryzening
Processor	AMD Ryzen 9 5900X
Motherboard	MSI X570 MAG TOMAHAWK
Cooling	Lian Li Galahad 360mm AIO
Memory	32 GB G.Skill Trident Z F4-3733 (4x 8 GB)
Video Card(s)	Gigabyte RTX 3070 Ti
Storage	Boot: Transcend MTE220S 2TB, Kintson A2000 1TB, Seagate Firewolf Pro 14 TB
Display(s)	Acer Nitro VG270UP (1440p 144 Hz IPS)
Case	Lian Li O11DX Dynamic White
Audio Device(s)	iFi Audio Zen DAC
Power Supply	Seasonic Focus+ 750 W
Mouse	Cooler Master Masterkeys Lite L
Keyboard	Cooler Master Masterkeys Lite L
Software	Windows 10 x64

Processor	Intel i9 9900K @5GHz w/ Corsair H150i Pro CPU AiO w/Corsair HD120 RBG fan
Motherboard	Asus Z390 Maximus XI Code
Cooling	6x120mm Corsair HD120 RBG fans
Memory	Corsair Vengeance RBG 2x8GB 3600MHz
Video Card(s)	Asus RTX 3080Ti STRIX OC
Storage	Samsung 970 EVO Plus 500GB , 970 EVO 1TB, Samsung 850 EVO 1TB SSD, 10TB Synology DS1621+ RAID5
Display(s)	Corsair Xeneon 32" 32UHD144 4K
Case	Corsair 570x RBG Tempered Glass
Audio Device(s)	Onboard / Corsair Virtuoso XT Wireless RGB
Power Supply	Corsair HX850w Platinum Series
Mouse	Logitech G604s
Keyboard	Corsair K70 Rapidfire
Software	Windows 11 x64 Professional
Benchmark Scores	Firestrike - 23520 Heaven - 3670

System Name	PCGOD
Processor	AMD FX 8350@ 5.0GHz
Motherboard	Asus TUF 990FX Sabertooth R2 2901 Bios
Cooling	Scythe Ashura, 2×BitFenix 230mm Spectre Pro LED (Blue,Green), 2x BitFenix 140mm Spectre Pro LED
Memory	16 GB Gskill Ripjaws X 2133 (2400 OC, 10-10-12-20-20, 1T, 1.65V)
Video Card(s)	AMD Radeon 290 Sapphire Vapor-X
Storage	Samsung 840 Pro 256GB, WD Velociraptor 1TB
Display(s)	NEC Multisync LCD 1700V (Display Port Adapter)
Case	AeroCool Xpredator Evil Blue Edition
Audio Device(s)	Creative Labs Sound Blaster ZxR
Power Supply	Seasonic 1250 XM2 Series (XP3)
Mouse	Roccat Kone XTD
Keyboard	Roccat Ryos MK Pro
Software	Windows 7 Pro 64

Processor	Intel i9 9900K @5GHz w/ Corsair H150i Pro CPU AiO w/Corsair HD120 RBG fan
Motherboard	Asus Z390 Maximus XI Code
Cooling	6x120mm Corsair HD120 RBG fans
Memory	Corsair Vengeance RBG 2x8GB 3600MHz
Video Card(s)	Asus RTX 3080Ti STRIX OC
Storage	Samsung 970 EVO Plus 500GB , 970 EVO 1TB, Samsung 850 EVO 1TB SSD, 10TB Synology DS1621+ RAID5
Display(s)	Corsair Xeneon 32" 32UHD144 4K
Case	Corsair 570x RBG Tempered Glass
Audio Device(s)	Onboard / Corsair Virtuoso XT Wireless RGB
Power Supply	Corsair HX850w Platinum Series
Mouse	Logitech G604s
Keyboard	Corsair K70 Rapidfire
Software	Windows 11 x64 Professional
Benchmark Scores	Firestrike - 23520 Heaven - 3670

System Name	Pioneer
Processor	Ryzen R9 9950X
Motherboard	GIGABYTE Aorus Elite X670 AX
Cooling	Noctua NH-D15 + A whole lotta Sunon and Corsair Maglev blower fans...
Memory	64GB (4x 16GB) G.Skill Flare X5 @ DDR5-6000 CL30
Video Card(s)	XFX RX 7900 XTX Speedster Merc 310
Storage	Intel 905p Optane 960GB boot, +2x Crucial P5 Plus 2TB PCIe 4.0 NVMe SSDs
Display(s)	55" LG 55" B9 OLED 4K Display
Case	Thermaltake Core X31
Audio Device(s)	TOSLINK->Schiit Modi MB->Asgard 2 DAC Amp->AKG Pro K712 Headphones or HDMI->B9 OLED
Power Supply	FSP Hydro Ti Pro 850W
Mouse	Logitech G305 Lightspeed Wireless
Keyboard	WASD Code v3 with Cherry Green keyswitches + PBT DS keycaps
Software	Gentoo Linux x64 / Windows 11 Enterprise IoT 2024

Microsoft Pushes New Software-Based Spectre, Meltdown Mitigation Patches

Raevenlord

News Editor

CrAsHnBuRnXp

eidairaman1

The Exiled Airman

CrAsHnBuRnXp

R-T-B

phanbuey

Patriot

R-T-B

Patriot

rtwjunkie

PC Gaming Enthusiast

R-T-B

Patriot

CrAsHnBuRnXp

ensabrenoir

Prima.Vera

TheGuruStud

evernessince

cdawall

where the hell are my stars

CrAsHnBuRnXp

R-T-B

fullinfusion

Vanguard Beta Tester

Patriot

cdawall

where the hell are my stars

System Name	Planet Espresso
Processor	13700KF @ 5.5GHZ 1.285v - 235W cap
Motherboard	MSI 690-I PRO
Cooling	Thermalright Phantom Spirit EVO
Memory	48 GB DDR5 7600 MHZ CL36
Video Card(s)	RTX 4090 FE
Storage	2TB WD SN850, 4TB WD SN850X
Display(s)	Alienware 32" 4k 240hz OLED
Case	Jonsbo Z20
Audio Device(s)	Yes
Power Supply	Corsair SF750
Mouse	Xlite V2
Keyboard	65% HE Keyboard
Software	Windows 11
Benchmark Scores	They're pretty good, nothing crazy.

System Name	[H]arbringer
Processor	4x 61XX ES @3.5Ghz (48cores)
Motherboard	SM GL
Cooling	3x xspc rx360, rx240, 4x DT G34 snipers, D5 pump.
Memory	16x gskill DDR3 1600 cas6 2gb
Video Card(s)	blah bigadv folder no gfx needed
Storage	32GB Sammy SSD
Display(s)	headless
Case	Xigmatek Elysium (whats left of it)
Audio Device(s)	yawn
Power Supply	Antec 1200w HCP
Software	Ubuntu 10.10
Benchmark Scores	http://valid.canardpc.com/show_oc.php?id=1780855 http://www.hwbot.org/submission/2158678 http://ww

Processor	Core i9-9900k
Motherboard	ASRock Z390 Phantom Gaming 6
Cooling	All air: 2x140mm Fractal exhaust; 3x 140mm Cougar Intake; Enermax ETS-T50 Black CPU cooler
Memory	32GB (2x16) Mushkin Redline DDR-4 3200
Video Card(s)	ASUS RTX 4070 Ti Super OC 16GB
Storage	1x 1TB MX500 (OS); 2x 6TB WD Black; 1x 2TB MX500; 1x 1TB BX500 SSD; 1x 6TB WD Blue storage (eSATA)
Display(s)	Infievo 27" 165Hz @ 2560 x 1440
Case	Fractal Design Define R4 Black -windowed
Audio Device(s)	Soundblaster Z
Power Supply	Seasonic Focus GX-1000 Gold
Mouse	Coolermaster Sentinel III (large palm grip!)
Keyboard	Logitech G610 Orion mechanical (Cherry Brown switches)
Software	Windows 10 Pro 64-bit (Start10 & Fences 3.0 installed)

System Name	iJayo
Processor	i7 14700k
Motherboard	Asus ROG STRIX z790-E wifi
Cooling	Pearless Assasi
Memory	32 gigs Corsair Vengence
Video Card(s)	Nvidia RTX 2070 Super
Storage	1tb 840 evo, Itb samsung M.2 ssd 1 & 3 tb seagate hdd, 120 gig Hyper X ssd
Display(s)	42" Nec retail display monitor/ 34" Dell curved 165hz monitor
Case	O11 mini
Audio Device(s)	M-Audio monitors
Power Supply	LIan li 750 mini
Mouse	corsair Dark Saber
Keyboard	Roccat Vulcan 121
Software	Window 11 pro
Benchmark Scores	meh... feel me on the battle field!

Processor	Intel® Core™ i7-13700K
Motherboard	Gigabyte Z790 Aorus Elite AX
Cooling	Noctua NH-D15
Memory	32GB(2x16) DDR5@6600MHz G-Skill Trident Z5
Video Card(s)	ZOTAC GAMING GeForce RTX 3080 AMP Holo
Storage	2TB SK Platinum P41 SSD + 4TB SanDisk Ultra SSD + 500GB Samsung 840 EVO SSD
Display(s)	Acer Predator X34 3440x1440@100Hz G-Sync
Case	NZXT PHANTOM410-BK
Audio Device(s)	Creative X-Fi Titanium PCIe
Power Supply	Corsair 850W
Mouse	Logitech Hero G502 SE
Software	Windows 11 Pro - 64bit
Benchmark Scores	30FPS in NFS:Rivals

Processor	OCed 5800X3D
Motherboard	Asucks C6H
Cooling	Air
Memory	32GB
Video Card(s)	OCed 6800XT
Storage	NVMees
Display(s)	32" Dull curved 1440
Case	Freebie glass idk
Audio Device(s)	Sennheiser
Power Supply	Don't even remember

Processor	Ryzen 7800X3D
Motherboard	ASRock X670E Taichi
Cooling	Noctua NH-D15 Chromax
Memory	32GB DDR5 6000 CL30
Video Card(s)	MSI RTX 4090 Trio
Storage	Too much
Display(s)	Acer Predator XB3 27" 240 Hz
Case	Thermaltake Core X9
Audio Device(s)	Topping DX5, DCA Aeon II
Power Supply	Seasonic Prime Titanium 850w
Mouse	G305
Keyboard	Wooting HE60
VR HMD	Valve Index
Software	Win 10

System Name	All the cores
Processor	2990WX
Motherboard	Asrock X399M
Cooling	CPU-XSPC RayStorm Neo, 2x240mm+360mm, D5PWM+140mL, GPU-2x360mm, 2xbyski, D4+D5+100mL
Memory	4x16GB G.Skill 3600
Video Card(s)	(2) EVGA SC BLACK 1080Ti's
Storage	2x Samsung SM951 512GB, Samsung PM961 512GB
Display(s)	Dell UP2414Q 3840X2160@60hz
Case	Caselabs Mercury S5+pedestal
Audio Device(s)	Fischer HA-02->Fischer FA-002W High edition/FA-003/Jubilate/FA-011 depending on my mood
Power Supply	Seasonic Prime 1200w
Mouse	Thermaltake Theron, Steam controller
Keyboard	Keychron K8
Software	W10P