Windows Client Guidance against speculative execution vulnerabilities

Polo6RGTI said:

More bad news...

Ex-Intel security expert: This new Spectre attack can even reveal firmware secrets | ZDNet

Hope we have a fix soon. I wonder how long the intelligence agencies have been exploiting this vulnerability?

fdegrove said:

Hi,



Bios/UEFI flash update is persistent and is not written to volatile memory on the cpu.
As far as mitigation against Spectre type attacks is concerned it really makes no difference whether the OS tells itself it is reading the MC it is told to read resides inside the CPU or it fools itself reading it from what? L3 CPU cache ?
I somewhat doubt it would cache it to L3 CPU volatile cache as any volatile memory would do but it really does not matter.

Point is, both methods are safe and yes BIOS/UEFI flash is persistent whereas OS MCU is not but the end result is the same securitywise.

To me emulation is like "make believe". All OS's do it and so on. Anyway, just semantics really.

Cheers,

Just stop spreading nonsense. I remember your post where you insist that Microcode is persistent in the CPU and that after an update you can just swap CPU into another MB and check that this is true.

Now comes your next nonsense: I quote: "Bios/UEFI flash update is persistent and is not written to volatile memory on the cpu."

What is persistent in BIOS is the Microcode which the CPU is instructed to load upon boot. This happens on every boot and hence the Microcode is as current as the BIOS version at this moment. The OS, namely Windows (since XP) and also Linux have the capability to yet again alter the Microcode of the CPU.

Here is a small batch file showing Microcode version loaded into CPU from BIOS and also subsequent Microcode version loaded by Windows afterwards.

Code:

@Echo off
REM MicroCode Update Check Batch File

reg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
ECHO.
ECHO.
Echo *** Press any Key to Close the Window when Done Reviewing your Results***
ECHO.
ECHO.
pause

Stop spreading nonsense.

f14tomcat said:

How do I read this? What means what? Thanks.....

Code:

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
    Component Information    REG_BINARY    00000000000000000000000000000000
    Identifier    REG_SZ    Intel64 Family 6 Model 158 Stepping 9
    Configuration Data    REG_FULL_RESOURCE_DESCRIPTOR    FFFFFFFFFFFFFFFF0000000000000000
    ProcessorNameString    REG_SZ    Intel(R) Core(TM) i7-7700K CPU @ 4.20GHz
    VendorIdentifier    REG_SZ    GenuineIntel
    FeatureSet    REG_DWORD    0x3d1b3fff
    ~MHz    REG_DWORD    0x1068
    Update Revision    REG_BINARY    0000000084000000
    Update Status    REG_DWORD    0x7
    Previous Update Revision    REG_BINARY    0000000084000000
    Platform Specific Field 1    REG_DWORD    0x2



*** Press any Key to Close the Window when Done Reviewing your Results***


Press any key to continue . . .

Means that your BIOS already contains version 0x84 Microcode and that Windows has exact same version onboard.

f14tomcat said:

Thanks, guess that means it's all ok.

Nobody can say at this moment if all ok however, it means that your listed CPU is executing instructions based upon the latest Microcode available for it.

Bree said:

For comparison, this is how it looks when the bios doesn't contain the updated microcode but Windows does.

Code:

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
    Component Information    REG_BINARY    00000000000000000000000000000000
    Identifier    REG_SZ    Intel64 Family 6 Model 42 Stepping 7
    Configuration Data    REG_FULL_RESOURCE_DESCRIPTOR    FFFFFFFFFFFFFFFF0000000000000000
    ProcessorNameString    REG_SZ    Intel(R) Pentium(R) CPU B950 @ 2.10GHz
    VendorIdentifier    REG_SZ    GenuineIntel
    FeatureSet    REG_DWORD    0x211b3ffe
    ~MHz    REG_DWORD    0x82f
    Update Revision    REG_BINARY    000000002D000000
    Update Status    REG_DWORD    0x0
    Previous Update Revision    REG_BINARY    0000000028000000
    Platform Specific Field 1    REG_DWORD    0x10

Also it can show base Microcode level for specific CPU before applying KB4100347 for example

i7-3770K on DZ77RE-75K mobo with bios version 066 from 2013:

BIOS Microcode version(Previous Update Revision): 0x17
Windows 10 - 1803 - 17134.1 (Update Revision): 0x1C
Intel Released on 25.4.2018 for CPU: 0x1F
KB4100347 installed (Update Revision): 0x1F

Another example: Samsung Laptop with i3-380M

BIOS Microcode version(Previous Update Revision): 0x02
Windows 10 - 1803 - 17134.1 (Update Revision): 0x04
Intel Released on 25.4.2018 for CPU: 0x06
KB4100347 installed (Update Revision): 0x04 (Latest Intel release NOT INCLUDED by Microsoft YET)