Windows 10: Protect your Windows devices against Spectre and Meltdown

Page 1 of 7 123 ... LastLast

  1. Posts : 27,145
    64-bit Windows 10 Pro build 17604
       09 Jan 2018 #1

    Protect your Windows devices against Spectre and Meltdown


    This article discusses the impact of the recently disclosed processor vulnerabilities, named “Spectre” and “Meltdown,” for Windows customers and provides resources to help keep your devices protected at home, at work, and across your enterprise.

    Summary

    Microsoft is aware of new vulnerabilities in hardware processors named “Spectre” and “Meltdown”. These are a newly discovered class of vulnerabilities based on a common chip architecture that, when originally designed, was created to speed up computers. The technical name is “speculative execution side-channel vulnerabilities”. You can learn more about these vulnerabilities at Google Project Zero.

    Who is affected?

    Affected chips include those manufactured by Intel, AMD, and ARM, which means all devices running Windows operating systems are potentially vulnerable (e.g., desktops, laptops, cloud servers, and smartphones). Devices running other operating systems such as Android, Chrome, iOS, and MacOS are also affected. We advise customers running these operating systems to seek guidance from those vendors.

    At this time of publication, we have not received any information to indicate that these vulnerabilities have been used to attack customers.

    Protections we’ve provided to date

    As of January 3, 2018, Microsoft released several updates to help mitigate these vulnerabilities and help protect customers. We have also deployed updates to secure our cloud services and Internet Explorer and Microsoft Edge browsers. We are continuing to work closely with industry partners including chip makers, device manufacturers, and app vendors.

    What steps should I take to protect my devices?

    You will need to update both your hardware and your software to address this vulnerability. This includes firmware updates from device manufacturers and, in some cases, updates to your antivirus software as well.

    To receive all available protections, follow these steps to get the latest updates for both software and hardware:

    Note   Note
    Before your begin, make sure your antivirus (AV) software is up to date and compatible. Check your antivirus software manufacturer's website for their latest compatibility information.

    • Keep your Windows device up to date by turning on automatic updates.
    • Check that you’ve installed the January 2018 Windows operating system security update from Microsoft. If automatic updates are turned on, the updates should be automatically delivered to you, but you should still confirm that they’re installed. For instructions, see Windows Update: FAQ
    • Install available hardware (firmware) updates from your device manufacturer. All customers will need to check with their device manufacturer to download and install their device specific hardware update. See below for a list of device manufacturer websites.
      Note   Note
      Customers who only install the January 2018 Windows operating system security updates from Microsoft will not be fully protected against the vulnerabilities. Antivirus software updates should be installed first. Operating system and firmware updates should follow.

    Resources

    Depending on your role, the following support articles will help you identify and mitigate client and server environments that are affected by the Spectre and Meltdown vulnerabilities.


    Additional resources

    List of OEM /Server device manufacturers

    Use the links below to check with your device manufacturer for firmware updates. You will need to install both operating system and hardware/firmware updates for all available protections.



    January 2018 Windows operation system update schedule


    The security updates released in January 2018 provide mitigations for devices running the following x64-based Windows operating systems. See FAQ for further information.

    Product Update Released Released Release Date Release Channel KB
    Windows 10 - Version 1709 / Windows Server 2016 (1709) / IoT Core - Quality Update Released January 3 WU, WSUS, Catalog, Azure Image Gallery KB4056892
    Windows Server 2016 (1709) - Server container Released January 5 Docker Hub KB4056892
    Windows 10 - Version 1703 / IoT Core - Quality Update Released January 3 WU, WSUS, Catalog KB4056891
    Windows 10 - Version 1607 / Windows Server 2016 / IoT Core- Quality Update Released January 3 WU, WSUS, Catalog KB4056890
    Windows Server 2016 (1607) - Container Images Released January 4 Docker Hub KB4056890
    Windows 10 - Version 1511 / IoT Core - Quality Update Released January 3 WU, WSUS, Catalog KB4056888
    Windows 10 - Version RTM - Quality Update Released January 3 WU, WSUS, Catalog KB4056893
    Windows 10 Mobile (OS Build 15254.192) - ARM Released January 5 WU, Catalog KB4073117
    Windows 10 Mobile (OS Build 15063.850) Released January 5 WU, Catalog KB4056891
    Windows 10 Mobile (OS Build 14393.2007) Released January 5 WU, Catalog KB4056890
    Windows 10 HoloLens Released January 5 WU, Catalog KB4056890
    Windows 8.1 / Windows Server 2012 R2 - Security Only Update Released January 3 WSUS, Catalog KB4056898
    Windows Embedded 8.1 Industry Enterprise Released January 3 WSUS, Catalog KB4056898
    Windows Embedded 8.1 Industry Pro Released January 3 WSUS, Catalog KB4056898
    Windows Embedded 8.1 Pro Released January 3 WSUS, Catalog KB4056898
    Windows 8.1 / Windows Server 2012 R2 Monthly Rollup Released January 8 WU, WSUS, Catalog KB4056895
    Windows Embedded 8.1 Industry Enterprise Released January 8 WU, WSUS, Catalog KB4056895
    Windows Embedded 8.1 Industry Pro Released January 8 WU, WSUS, Catalog KB4056895
    Windows Embedded 8.1 Pro Released January 8 WU, WSUS, Catalog KB4056895
    Windows Server 2012 Security Only Coming WSUS, Catalog
    Windows Server 2008 SP2 Coming WU, WSUS, Catalog
    Windows Server 2012 Monthly Rollup Coming WU, WSUS, Catalog
    Windows Embedded 8 Standard Coming
    Windows 7 SP1 / Windows Server 2008 R2 - Security Only Update Released January 3 WSUS, Catalog KB4056897
    Windows Embedded Standard 7 Released January 3 WSUS, Catalog KB4056897
    Windows Embedded POSReady 7 Released January 3 WSUS, Catalog KB4056897
    Windows Thin PC Released January 3 WSUS, Catalog KB4056897
    Windows 7 SP1 / Windows Server 2008 R2 Monthly Rollup Released January 4 WU, WSUS, Catalog KB4056894
    Windows Embedded Standard 7 Released January 4 WU, WSUS, Catalog KB4056894
    Windows Embedded POSReady 7 Released January 4 WU, WSUS, Catalog KB4056894
    Windows Thin PC Released January 4 WU, WSUS, Catalog KB4056894
    Internet Explorer 11-Cumulative Update for Windows 7 SP1 and Windows 8.1 Released January 3 WU, WSUS, Catalog KB4056568

    Frequently asked questions

    My OEM device manufacturer is not listed. What do I do?
    You will need to check with your device manufacturer for firmware updates. If your device manufacturer is not listed in the table, contact your OEM directly.

    Where can I find Surface hardware/firmware updates?
    Updates for Microsoft Surface devices will be delivered to customers through Windows Update. For more information, see KB 4073065.

    If your device is not from Microsoft, apply firmware from the device manufacturer. Contact your device manufacturer for more information.

    My operating system (OS) is not listed. When can I expect a fix to be released?
    Addressing a hardware vulnerability with a software update presents significant challenges and mitigations for older operating systems and can require extensive architectural changes. We are continuing to work with affected chip manufacturers and investigating the best way to provide mitigations, which may be provided in a future update. Replacing older devices running these older operating systems should address the remaining risk along with updated antivirus software.

    Note   Note
    Products currently out of both mainstream and extended support will not receive these OS updates. We recommend customers update to a supported OS version.

    We will not be issuing updates for the following platforms:
    • Windows operating systems that are currently out of support or those entering end of service (EOS) in 2018
    • Windows XP-based systems including WES 2009, POSReady 2009


    Although Windows XP-based systems are affected products, Microsoft is not issuing an update for them because the comprehensive architectural changes required would jeopardize system stability and cause application compatibility problems. We recommend that security-conscious customers upgrade to a newer supported operating system to keep pace with the changing security threat landscape and benefit from the more robust protections that newer operating systems provide.

    If I have installed the security updates released by Microsoft on January 3, 2018. Do I need to do anything else?
    After you have installed the January Microsoft security update, you will also need to install firmware updates from your device manufacturer. These updates should be available on your device manufacturer's website. Antivirus software updates should be installed first. Operating system and firmware updates can be installed in either order.

    Am I fully protected if I only install Windows security updates?
    You will need to update both your hardware and your software to address this vulnerability. You will also need to install related firmware updates from your device manufacturer for more comprehensive protection.

    Why is it so important to update my device with the latest feature release?
    In each Windows 10 feature update, we build the latest security technology deep into the operating system, providing defense-in-depth features that prevent entire classes of malware from impacting your device. Feature update releases are targeted twice a year. In each monthly quality update, we add another layer of security, one that tracks emerging and changing trends in malware to make up-to-date systems safer in the face of changing and evolving threats.

    My antivirus software is not listed as being compatible. What should I do?
    Microsoft has been working closely with affected antivirus partners to ensure all customers receive the January Windows security updates as soon as possible. If customers are not being offered January security updates, Microsoft recommends customers contact their antivirus provider directly. Recommendations:

    • Ensure your devices are up to date with the latest security updates from Microsoft and from your hardware manufacturer. For more info on keeping your device up to date, see Windows Update: FAQ.
    • Continue to practice sensible caution when visiting websites of unknown origin and do not remain on sites you do not trust. Microsoft recommends all customers protect their devices by running a supported antivirus program. Customers can also take advantage of built-in antivirus protection: Windows Defender for Windows 10 devices, or Microsoft Security Essentials for Windows 7 devices. These solutions are compatible in cases where customers can’t install or run antivirus software.

    I wasn’t offered the Windows security updates that were released on January 3, 2018. What should I do?
    To help avoid adversely affecting customer devices, the Windows security updates that were released on January 3, 2018, have not been offered to all customers. For details, see the following: Microsoft Knowledge Base Article 4072699 and Microsoft Knowledge Base Article 4073707.

    Intel has identified reboot issues with microcode on some older processors. What should I do?
    Intel has reported issues with recently released microcode meant to address Spectre variant 2 (CVE 2017-5715 Branch Target Injection) – specifically Intel noted that this microcode can cause “higher than expected reboots and other unpredictable system behavior” and then noted that situations like this may result in “data loss or corruption.” Our own experience is that system instability can in some circumstances cause data loss or corruption. On January 22, Intel recommended that customers stop deploying the current microcode version on impacted processors while they perform additional testing on the updated solution. We understand that Intel is continuing to investigate the potential impact of the current microcode version and encourage customers to review their guidance on an ongoing basis to inform their decisions.

    While Intel tests, updates and deploys new microcode, we are making available an out of band update today, KB4078130, that specifically disables only the mitigation against CVE-2017-5715 – “Branch target injection vulnerability.” In our testing this update has been found to prevent the behavior described. For the full list of devices, see Intel’s microcode revision guidance. This update covers Windows 7 (SP1), Windows 8.1, and all versions of Windows 10, for client and server. If you are running an impacted device, this update can be applied by downloading it from the Microsoft Update Catalog website. Application of this payload specifically disables only the mitigation against CVE-2017-5715 – “Branch target injection vulnerability.”

    As of January 25, there are no known reports to indicate that this Spectre variant 2 (CVE 2017-5715 ) has been used to attack customers. We recommend Windows customers, when appropriate, reenable the mitigation against CVE-2017-5715 when Intel reports that this unpredictable system behavior has been resolved for your device.


    Source: https://support.microsoft.com/en-us/...ectre-meltdown


    See also:
    Last edited by Brink; 2 Weeks Ago at 10:01.
      My ComputersSystem Spec

  2.    09 Jan 2018 #2

    Where to find the list of updated and compatible antivirus-programs?
      My ComputerSystem Spec

  3.   My ComputersSystem Spec

  4.    09 Jan 2018 #4

    Thank you, Brink .
      My ComputerSystem Spec


  5. Posts : 27,145
    64-bit Windows 10 Pro build 17604
    Thread Starter
       09 Jan 2018 #5

      My ComputersSystem Spec


  6. Posts : 31,034
    Triple boot - Win 10 Pro, Win 10 Pro Insider (2) - (and a sprinkling of VMs)
       09 Jan 2018 #6

    Timely, timely, timely! Wish there were a way you could pin this to the top of Forum main page. Thank you!
      My ComputersSystem Spec

  7.    09 Jan 2018 #7

    Microsoft halts distribution of Spectre & Meltdown fixes on AMD systems after reports of unbootable PCs

    Windows OS security update block for some AMD based devices - Windows 10 Forums
    Last edited by Brink; 09 Jan 2018 at 18:14. Reason: updated link
      My ComputerSystem Spec


  8. Posts : 8
    win10 64x home retail
       10 Jan 2018 #8

    Funny.. MSI also a big player and nothing but silence even on their forums...
      My ComputerSystem Spec


  9. Posts : 38,043
    Dual boot Windows 10 FCU Pro x 64 & current Insider 10 Pro
       10 Jan 2018 #9

    Thanks for putting this all together in one place, Shawn.

    I see ASUS nor AMD aren't concerned about the vulnerability. Why is it all just Intel?
      My ComputersSystem Spec


  10. Posts : 254
    Windows 10 preview 64-bit
       10 Jan 2018 #10

    Many thanks Brink.
      My ComputerSystem Spec


 
Page 1 of 7 123 ... LastLast

Related Threads
I am running FCU Win 10 Pro on a MSI P35 Neo F v1 motherboard with Core 2 Duo E8400 CPU. I have ran the MS controlsettings script which informs me I am protected from Spectre by Windows Update but not Meltdown without a BIOS/Microcode update. As...
Emergency Windows Meltdown patch locks some AMD PCs into endless loop - TechRepublic
Source: Understanding the performance impact of Spectre and Meltdown mitigations on Windows Systems Microsoft Secure
Source: Meltdown and Spectre: what you need to know - Malwarebytes Labs | Malwarebytes Labs See also: Windows Client Guidance against speculative execution vulnerabilities - Windows 10 Forums
Hi,I have purchased the above machine and need some advice on a few aspects...HP have loaded their own updater/messages/support software which I would like to unload. Is this safe and recommended? Will removing this also remove any HP loaded device...
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 16:32.
Find Us