Windows Client Guidance against speculative execution vulnerabilities

fdegrove said:

Hi,

Yes but it then should also be available from the OEM website either as a bios/efi flash or as an Intel ME flash IMHO.

I just checked with my OEM and flashes for cpu microcode will be available for three of my machines starting from cw 05. Good to know.



MS has already done what it is supposed to do. That part is safe now. But it's the hardware that still requires patching for the majority of us endusers.
Cheers,

That explains why I have a mixed result after running the Spectre Meltdown CPU checker (my post #216). I am green (check) for Meltdown and red (check) for Spectre. As we all know, the latter is more concerned with all Intel CPUs while Meltdown goes for the others. So far, HP doesn't seem to be in a hurry to release a BIOS/UEFI firmware update. At least, in your case, you have some information about when you will probably receive a fix from your OEM. That is not the case for HP support site, unless I don't know where to look..

"MS has already done what it is supposed to do. That part is safe now. But it's the hardware that still requires patching for the majority of us endusers"

It's a fact that MS has already done its part. That's the point, if the OEM of one's PC hasn't released any update with respect to that issue, the next MS's Security update might not be able to install as we are witnessing with the last out-of-band patch KB4056892. Some users are still having difficulty in installing this update. :)

Hi,

As we all know, the latter is more concerned with all Intel CPUs while Meltdown goes for the others.

Not quite @IronZorg89. Both affect most CPU manufacturers and OS's.

Meltdown got its name because it "melts" security boundaries normally enforced by hardware. By exploiting Meltdown, an attacker can use a program running on a machine to gain access to data from all over that machine that the program shouldn't normally be able to see, including data belonging to other programs and data that only administrators should have access to. Meltdown doesn't require too much knowledge of how the program the attacker hijacks works, but it only works with specific kinds of Intel chips. This is a pretty severe problem but fixes are being rolled out.

By exploiting the Spectre variants, an attacker can make a program reveal some of its own data that should have been kept secret. It requires more intimate knowledge of the victim program's inner workings, and doesn't allow access to other programs' data, but will also work on just about any computer chip out there. Spectre's name comes from speculative execution but also derives from the fact that it will be much trickier to stop — while patches are starting to become available, other attacks in the same family will no doubt be discovered. That's the other reason for the name: Spectre will be haunting us for some time.

Source CSO :

https://www.csoonline.com/article/32...s-at-risk.html

That is not the case for HP support site, unless I don't know where to look..

HP being an Intel partner just like Fujitsu I think they have publicized a schedule of the planned releases and the affected products.
Mind you, I had to search for it as well. I think your best start is Intel's website where they discuss Spectre and Meltdown and cite a list of their partners with links to the respective website pages.

I'll see if I can find something useful for you and our other HP users.

Cheers,

tried to call MSI today they appear to be closed for the holiday , since when does a business close for MLK day thats a new one, i new schools and stuff closed but all my local business are open.

Hi,

For HP owners :

https://support.hp.com/us-en/document/c05869091

Intel partners:

https://www.intel.com/content/www/us...roducts.html#2

Cheers,

Hi,

You're most welcome.

When I look at it, in my case, I only need a BIOS/UEFI update from HP and so far I don't think they have released one yet.

That's correct from what I've seen from the screenshots you posted earlier on. We're both in the same boat here.

Cheers,

If anyone is having trouble running the Powershell script here's one more alternative (requires .NET 4.5).
If ran as administrator it also allows you to disable the windows patches.

Utility for mitigations CVE-2017-5715 and CVE-2017-5754 status check | guru3D Forums



@dencal

According Microsoft your Surface Pro isn't affected by the Management Engine

Intel Management Engine Vulnerability and Surface Devices Surface

..yet they released firmware update January 10. Have you installed it?

https://support.microsoft.com/en-us/...update-history