Windows 10: Protect your Windows devices against Spectre and Meltdown

Page 1 of 8 123 ... LastLast

  1. Posts : 29,302
    64-bit Windows 10 Pro build 17672
       09 Jan 2018 #1

    Protect your Windows devices against Spectre and Meltdown


    Summary

    This article discusses the impact of the recently disclosed processor vulnerabilities, named “Spectre” and “Meltdown,” for Windows customers. This article also provides resources to help keep your devices protected at home, at work, and across your enterprise.

    Microsoft is aware of new vulnerabilities in hardware processors named “Spectre” and “Meltdown”. These are a newly discovered class of vulnerabilities based on a common chip architecture that, when originally designed, was created to speed up computers. The technical name is “speculative execution side-channel vulnerabilities”. You can learn more about these vulnerabilities at Google Project Zero.

    Steps to help protect your Windows devices

    What steps should I take to protect my devices?

    You will need to update both your hardware and your software to address this vulnerability. This includes applicable firmware updates from device manufacturers and, in some cases, updates to your antivirus software as well. We encourage you to keep your devices up-to-date by installing the monthly security updates.

    To receive all available protections, follow these steps to get the latest updates for both software and hardware.

    Note   Note
    Before your begin, make sure your antivirus (AV) software is up to date and compatible. Check your antivirus software manufacturer's website for their latest compatibility information.

    • Keep your Windows device up to date by turning on automatic updates.
    • Check that you’ve installed the January 2018 Windows operating system security update from Microsoft. If automatic updates are turned on, the updates should be automatically delivered to you, but you should still confirm that they’re installed. For instructions, see Windows Update: FAQ
    • Install available hardware (firmware) updates from your device manufacturer. All customers will need to check with their device manufacturer to download and install their device specific hardware update. See below for a list of device manufacturer websites.
      Note   Note
      Customers should install the latest Windows operating system security updates from Microsoft to take advantage of available protections. Antivirus software updates should be installed first. Operating system and firmware updates should follow. We encourage you to keep your devices up-to-date by installing the monthly security updates.

    Who is affected?

    Affected chips include those that are manufactured by Intel, AMD, and ARM. This means that all devices that are running Windows operating systems are potentially vulnerable. This includes desktops, laptops, cloud servers, and smartphones. Devices that are running other operating systems, such as Android, Chrome, iOS, and MacOS, are also affected. We advise customers who are running these operating systems to seek guidance from those vendors.

    At this time of publication, we have not received any information to indicate that these vulnerabilities have been used to attack customers.

    Protections we’ve provided to date

    Starting in January 2018, Microsoft released updates for Windows operating systems and the Internet Explorer and Edge web browsers to help mitigate these vulnerabilities and help to protect customers. We also released updates to secure our cloud services. We continue working closely with industry partners, including chip makers, hardware OEMs, and app vendors, to protect customers against this class of vulnerability.

    We encourage you to always install the monthly updates to keep your devices up-to-date and secure.

    We will update this documentation when new mitigations become available and recommend you check back here regularly.

    March 2018 Windows operating system updates

    Blog: March 2018 Windows Security Update – Expanding Our Efforts to Protect Customers

    Blog: Update on Spectre and Meltdown security updates for Windows devices

    Intel microcode updates
    Microsoft is making available Intel validated microcode updates around Spectre Variant 2 [CVE 2017-5715 ("Branch Target Injection”)]. KB4093836 lists specific Knowledge Base articles by Windows version. Each specific KB contains the available Intel microcode updates by CPU .

    We will offer additional microcode updates from Intel for the Windows operating system as they become available to Microsoft.

    Windows operating system updates for 32-bit (x86) systems
    Starting in March 2018, Microsoft released security updates to provide mitigations for devices running the following x86-based Windows operating systems. Customers should install latest Windows operating system security updates to take advantage of available protections. We are working to provide protections for other supported Windows versions but do not have a release schedule at this time. Please check back here for updates. For more information, see the related knowledge base article for technical details and the FAQ below.

    Product update released Released Release date Release channel KB
    Windows 8.1 & Windows Server 2012 R2 - Security Only Update Released 13-Mar WSUS, Catalog, KB4088879
    Windows 7 SP1 & Windows Server 2008 R2 SP1 - Security Only Update Released 13-Mar WSUS, Catalog KB4088878
    Windows Server 2012 - Security Only Update
    Windows 8 Embedded Standard Edition - Security Only Update
    Released 13-Mar WSUS, Catalog KB4088877
    Windows 8.1 & Windows Server 2012 R2 - Monthly Rollup Released 13-Mar WU, WSUS, Catalog KB4088876
    Windows 7 SP1 & Windows Server 2008 R2 SP1 - Monthly Rollup Released 13-Mar WU, WSUS, Catalog KB4088875
    Windows Server 2012 - Monthly Rollup
    Windows 8 Embedded Standard Edition - Monthly Rollup
    Released 13-Mar WU, WSUS, Catalog KB4088877
    Windows Server 2008 SP2 Released 13-Mar WU, WSUS, Catalog KB4090450

    Windows operating system updates for 64-bit (x64) systems
    Starting in March 2018, Microsoft released security updates to provide mitigations for devices running the following x64-based Windows operating systems. Customers should install latest Windows operating system security updates to take advantage of available protections. We are working to provide protections for other supported Windows versions but do not have a release schedule at this time. Please check back here for updates. For more information, see the related knowledge base article for technical details and the FAQ later in this article.

    Product update released Released Release date Release channel KB
    Windows Server 2012 - Security Only Update
    Windows 8 Embedded Standard Edition - Security Only Update
    Released 13-Mar WSUS, Catalog KB4088877
    Windows Server 2012 - Monthly Rollup
    Windows 8 Embedded Standard Edition - Monthly Rollup
    Released 13-Mar WU, WSUS, Catalog KB4088877
    Windows Server 2008 SP2 Released 13-Mar WU, WSUS, Catalog KB4090450

    Cumulative security update for Internet Explorer
    This security update resolves several reported vulnerabilities in Internet Explorer. To learn more about these vulnerabilities, see Microsoft Common Vulnerabilities and Exposures.

    Product update released Released Release date Release channel KB
    Internet Explorer 10 - Cumulative Update for Windows 8 Embedded Standard Edition Released 13-Mar WU, WSUS, Catalog KB4089187

    February 2018 Windows operating system updates

    Blog: Windows Analytics now helps assess Spectre and Meltdown protections

    Windows operating system updates for 32-bit (x86) systems
    The following security updates provide additional protections for devices running 32-bit (x86) Windows operating systems. Microsoft recommends customers install the update as soon as available. We continue to work to provide protections for other supported Windows versions but do not have a release schedule at this time. Please check back here for updates.

    Note: Windows 10 monthly security updates are cumulative month over month and will be downloaded and installed automatically from Windows Update. If you have installed earlier updates, only the new portions will be downloaded and installed on your device. For more information, see the related knowledge base article for technical details and the FAQ below.

    Product update released Released Release date Release channel KB
    Windows 10 - Version 1709 / Windows Server 2016 (1709) / IoT Core - Quality Update Released January 31 WU, Catalog KB4058258
    Windows Server 2016 (1709) - Server container Released February 13 Docker Hub KB4074588
    Windows 10 - Version 1703 / IoT Core - Quality Update Released February 13 WU, WSUS, Catalog KB4074592
    Windows 10 - Version 1607 / Windows Server 2016 / IoT Core - Quality Update Released February 13 WU, WSUS, Catalog KB4074590
    Windows 10 HoloLens - OS and Firmware Updates Released February 13 WU, Catalog KB4074590
    Windows Server 2016 (1607) - Container Images Released February 13 Docker Hub KB4074590
    Windows 10 - Version 1511 / IoT Core - Quality Update Released February 13 WU, WSUS, Catalog KB4074591
    Windows 10 - Version RTM - Quality Update Released February 13 WU, WSUS, Catalog KB4074596

    January 2018 Windows operation system updates

    Blog: Understanding the Performance Impact of Spectre and Meltdown Mitigations on Windows Systems

    Windows operating system updates for 64-bit (x64) systems
    Starting in January 2018, Microsoft released security updates to provide mitigations for devices running the following x64-based Windows operating systems. Customers should install latest Windows operating system security updates to take advantage of available protections. We are working to provide protections for other supported Windows versions but do not have a release schedule at this time. Please check back here for updates. For more information, see the related knowledge base article for technical details and the FAQ below.

    Product Update Released Released Release Date Release Channel KB
    Windows 10 - Version 1709 / Windows Server 2016 (1709) / IoT Core - Quality Update Released January 3 WU, WSUS, Catalog, Azure Image Gallery KB4056892
    Windows Server 2016 (1709) - Server container Released January 5 Docker Hub KB4056892
    Windows 10 - Version 1703 / IoT Core - Quality Update Released January 3 WU, WSUS, Catalog KB4056891
    Windows 10 - Version 1607 / Windows Server 2016 / IoT Core- Quality Update Released January 3 WU, WSUS, Catalog KB4056890
    Windows Server 2016 (1607) - Container Images Released January 4 Docker Hub KB4056890
    Windows 10 - Version 1511 / IoT Core - Quality Update Released January 3 WU, WSUS, Catalog KB4056888
    Windows 10 - Version RTM - Quality Update Released January 3 WU, WSUS, Catalog KB4056893
    Windows 10 Mobile (OS Build 15254.192) - ARM Released January 5 WU, Catalog KB4073117
    Windows 10 Mobile (OS Build 15063.850) Released January 5 WU, Catalog KB4056891
    Windows 10 Mobile (OS Build 14393.2007) Released January 5 WU, Catalog KB4056890
    Windows 10 HoloLens Released January 5 WU, Catalog KB4056890
    Windows 8.1 / Windows Server 2012 R2 - Security Only Update Released January 3 WSUS, Catalog KB4056898
    Windows Embedded 8.1 Industry Enterprise Released January 3 WSUS, Catalog KB4056898
    Windows Embedded 8.1 Industry Pro Released January 3 WSUS, Catalog KB4056898
    Windows Embedded 8.1 Pro Released January 3 WSUS, Catalog KB4056898
    Windows 8.1 / Windows Server 2012 R2 Monthly Rollup Released January 8 WU, WSUS, Catalog KB4056895
    Windows Embedded 8.1 Industry Enterprise Released January 8 WU, WSUS, Catalog KB4056895
    Windows Embedded 8.1 Industry Pro Released January 8 WU, WSUS, Catalog KB4056895
    Windows Embedded 8.1 Pro Released January 8 WU, WSUS, Catalog KB4056895
    Windows Server 2012 Security Only Coming WSUS, Catalog
    Windows Server 2008 SP2 Coming WU, WSUS, Catalog
    Windows Server 2012 Monthly Rollup Coming WU, WSUS, Catalog
    Windows Embedded 8 Standard Coming
    Windows 7 SP1 / Windows Server 2008 R2 - Security Only Update Released January 3 WSUS, Catalog KB4056897
    Windows Embedded Standard 7 Released January 3 WSUS, Catalog KB4056897
    Windows Embedded POSReady 7 Released January 3 WSUS, Catalog KB4056897
    Windows Thin PC Released January 3 WSUS, Catalog KB4056897
    Windows 7 SP1 / Windows Server 2008 R2 Monthly Rollup Released January 4 WU, WSUS, Catalog KB4056894
    Windows Embedded Standard 7 Released January 4 WU, WSUS, Catalog KB4056894
    Windows Embedded POSReady 7 Released January 4 WU, WSUS, Catalog KB4056894
    Windows Thin PC Released January 4 WU, WSUS, Catalog KB4056894
    Internet Explorer 11-Cumulative Update for Windows 7 SP1 and Windows 8.1 Released January 3 WU, WSUS, Catalog KB4056568

    Resources and technical guidance

    Depending on your role, the following support articles will help you identify and mitigate client and server environments that are affected by the Spectre and Meltdown vulnerabilities.

    Microsoft blogs discussing Spectre and Meltdown

    List of technical resources and customer guidance

    Links to OEM and Server device manufacturers for updates to protect again Spectre and Meltdown vulnerabilities

    To help address these vulnerabilities, you need to update both your hardware and software. Use the following links to check with your device manufacturer for applicable firmware updates.

    List of OEM /Server device manufacturers

    Use the following links to check with your device manufacturer for firmware updates. You will have to install both operating system and hardware or firmware updates for all available protections.



    Frequently asked questions

    My OEM device manufacturer is not listed. What do I do?
    You will need to check with your device manufacturer for firmware updates. If your device manufacturer is not listed in the table, contact your OEM directly.

    Where can I find Surface hardware/firmware updates?
    Updates for Microsoft Surface devices will be delivered to customers through Windows Update. For more information, see KB 4073065.

    If your device is not from Microsoft, apply firmware from the device manufacturer. Contact your device manufacturer for more information.

    My operating system (OS) is not listed. When can I expect a fix to be released?
    Addressing a hardware vulnerability with a software update presents significant challenges and mitigations for older operating systems and can require extensive architectural changes. We are continuing to work with affected chip manufacturers and investigating the best way to provide mitigations, which may be provided in a future update. Replacing older devices running these older operating systems should address the remaining risk along with updated antivirus software.

    Note   Note
    Products currently out of both mainstream and extended support will not receive these OS updates. We recommend customers update to a supported OS version.

    We will not be issuing updates for the following platforms:
    • Windows operating systems that are currently out of support or those entering end of service (EOS) in 2018
    • Windows XP-based systems including WES 2009, POSReady 2009


    Although Windows XP-based systems are affected products, Microsoft is not issuing an update for them because the comprehensive architectural changes required would jeopardize system stability and cause application compatibility problems. We recommend that security-conscious customers upgrade to a newer supported operating system to keep pace with the changing security threat landscape and benefit from the more robust protections that newer operating systems provide.

    Where can I find Microsoft HoloLens operating system and firmware updates?
    Updates to Windows 10 for HoloLens are available to HoloLens customers through Windows Update.

    After applying the February 2018 Windows Security Update HoloLens customers do not need to take any additional action to update their device firmware. These mitigations will also be included in all future releases of Windows 10 for HoloLens.

    Where can I find Windows 10 Mobile firmware updates?
    Contact your OEM for more information.

    If I have installed the latest security updates released by Microsoft. Do I need to do anything else?
    For your device to be fully protected, you should install the latest Windows operating system security updates for your device and applicable firmware updates from your device manufacturer. These updates should be available on your device manufacturer's website. Antivirus software updates should be installed first. Operating system and firmware updates can be installed in either order.

    Am I fully protected if I only install Windows security updates?
    You will need to update both your hardware and your software to address this vulnerability. You will also need to install applicable firmware updates from your device manufacturer for more comprehensive protection. We encourage you to keep your devices up-to-date by installing the monthly security updates.

    Why is it so important to update my device with the latest feature release?
    In each Windows 10 feature update, we build the latest security technology deep into the operating system, providing defense-in-depth features that prevent entire classes of malware from impacting your device. Feature update releases are targeted twice a year. In each monthly quality update, we add another layer of security, one that tracks emerging and changing trends in malware to make up-to-date systems safer in the face of changing and evolving threats.

    My antivirus software is not listed as being compatible. What should I do?
    Microsoft has been working closely with affected antivirus partners to ensure all customers receive the January Windows security updates as soon as possible. If customers are not being offered January security updates, Microsoft recommends customers contact their antivirus provider directly. Recommendations:

    • Ensure your devices are up to date with the latest security updates from Microsoft and from your hardware manufacturer. For more info on keeping your device up to date, see Windows Update: FAQ.
    • Continue to practice sensible caution when visiting websites of unknown origin and do not remain on sites you do not trust. Microsoft recommends all customers protect their devices by running a supported antivirus program. Customers can also take advantage of built-in antivirus protection: Windows Defender for Windows 10 devices, or Microsoft Security Essentials for Windows 7 devices. These solutions are compatible in cases where customers can’t install or run antivirus software.

    I wasn’t offered the Windows security updates that were released on January 3, 2018. What should I do?
    To help avoid adversely affecting customer devices, the Windows security updates released in January or February, , have not been offered to all customers. For details, see the Microsoft Knowledge Base Article 4072699.

    Intel has identified reboot issues with microcode on some older processors. What should I do?
    Intel has reported issues with recently released microcode meant to address Spectre variant 2 (CVE 2017-5715 Branch Target Injection) – specifically Intel noted that this microcode can cause “higher than expected reboots and other unpredictable system behavior” and then noted that situations like this may result in “data loss or corruption.” Our own experience is that system instability can in some circumstances cause data loss or corruption. On January 22, Intel recommended that customers stop deploying the current microcode version on impacted processors while they perform additional testing on the updated solution. We understand that Intel is continuing to investigate the potential impact of the current microcode version and encourage customers to review their guidance on an ongoing basis to inform their decisions.

    While Intel tests, updates and deploys new microcode, we are making available an out of band update today, KB4078130, that specifically disables only the mitigation against CVE-2017-5715 – “Branch target injection vulnerability.” In our testing this update has been found to prevent the behavior described. For the full list of devices, see Intel’s microcode revision guidance. This update covers Windows 7 (SP1), Windows 8.1, and all versions of Windows 10, for client and server. If you are running an impacted device, this update can be applied by downloading it from the Microsoft Update Catalog website. Application of this payload specifically disables only the mitigation against CVE-2017-5715 – “Branch target injection vulnerability.”

    As of January 25, there are no known reports to indicate that this Spectre variant 2 (CVE 2017-5715 ) has been used to attack customers. We recommend Windows customers, when appropriate, reenable the mitigation against CVE-2017-5715 when Intel reports that this unpredictable system behavior has been resolved for your device.

    I have not installed the January 2018 Security Only updates. If I install the February 2018 Security Only updates, am I protected from the vulnerabilities described in this advisory?
    Yes. While Security Only updates are not normally cumulative, to ensure customers are protected, Microsoft is including the mitigations against these vulnerabilities in the February Security Only updates. These updates also include the updates for AMD-based devices.

    If I apply any of the applicable February security updates, will they disable the protections for CVE-2017-5715 like security update 4078130 did?
    No. Security update 4078130 was a specific fix to prevent unpredictable system behaviors, performance issues, and/or unexpected reboots after installation of microcode. Applying the February security updates on Windows client operating systems enables all three mitigations. On Windows server operating systems, you still need to enable the mitigations after proper testing is performed. See Microsoft Knowledge Base Article 4072698 for more information.


    Source: https://support.microsoft.com/en-us/...ectre-meltdown


    See also:
    Last edited by Brink; 13 Mar 2018 at 15:22.
      My ComputersSystem Spec

  2.    09 Jan 2018 #1

    Where to find the list of updated and compatible antivirus-programs?
      My ComputerSystem Spec

  3.   My ComputersSystem Spec

  4.    09 Jan 2018 #3

    Thank you, Brink .
      My ComputerSystem Spec


  5. Posts : 29,302
    64-bit Windows 10 Pro build 17672
    Thread Starter
       09 Jan 2018 #4

      My ComputersSystem Spec


  6. Posts : 33,061
    Triple boot - Win 10 Pro, Win 10 Pro Insider (2) - (and a sprinkling of VMs)
       09 Jan 2018 #5

    Timely, timely, timely! Wish there were a way you could pin this to the top of Forum main page. Thank you!
      My ComputersSystem Spec

  7.    09 Jan 2018 #6

    Microsoft halts distribution of Spectre & Meltdown fixes on AMD systems after reports of unbootable PCs

    Windows OS security update block for some AMD based devices - Windows 10 Forums
    Last edited by Brink; 09 Jan 2018 at 18:14. Reason: updated link
      My ComputerSystem Spec


  8. Posts : 14
    win10 64x home retail
       10 Jan 2018 #7

    Funny.. MSI also a big player and nothing but silence even on their forums...
      My ComputerSystem Spec


  • Posts : 38,043
    Dual boot Windows 10 FCU Pro x 64 & current Insider 10 Pro
       10 Jan 2018 #8

    Thanks for putting this all together in one place, Shawn.

    I see ASUS nor AMD aren't concerned about the vulnerability. Why is it all just Intel?
      My ComputersSystem Spec


  • Posts : 343
    Windows 10 preview 64-bit Pro
       10 Jan 2018 #9

    Many thanks Brink.
      My ComputerSystem Spec


  •  
    Page 1 of 8 123 ... LastLast

    Related Threads
    I am running FCU Win 10 Pro on a MSI P35 Neo F v1 motherboard with Core 2 Duo E8400 CPU. I have ran the MS controlsettings script which informs me I am protected from Spectre by Windows Update but not Meltdown without a BIOS/Microcode update. As...
    Emergency Windows Meltdown patch locks some AMD PCs into endless loop - TechRepublic
    Source: Understanding the performance impact of Spectre and Meltdown mitigations on Windows Systems Microsoft Secure
    Source: Meltdown and Spectre: what you need to know - Malwarebytes Labs | Malwarebytes Labs See also: Windows Client Guidance against speculative execution vulnerabilities - Windows 10 Forums
    Hi,I have purchased the above machine and need some advice on a few aspects...HP have loaded their own updater/messages/support software which I would like to unload. Is this safe and recommended? Will removing this also remove any HP loaded device...
    Our Sites
    Site Links
    About Us
    Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

    © Designer Media Ltd
    All times are GMT -5. The time now is 05:36.
    Find Us