Slashdot Mirror
Microsoft Resumes Meltdown and Spectre Updates for AMD Devices (bleepingcomputer.com)
Microsoft has resumed the rollout of security updates for AMD devices. The updates patch the Meltdown and Spectre vulnerabilities. From a report: Microsoft released these patches on January 3, but the company stopped the rollout for AMD-based computers on January 9 after users reported crashes that plunged PCs into unbootable states. After working on smoothing out the problems with AMD, Microsoft announced today it would resume the rollout of five (out of nine) security updates.
AMD did make statements that is not effected by Meltdown, which was also stated by some other sources. Spectre however was verified on AMD according to the research release
Sent from my TARDIS
So is the title flamebait, as is usual for our new Slashdot overlords?
#DeleteFacebook
Spectre is pretty much anything with a modern chip, including Intel, AMD, and ARM. Some of the few exemptions were processors that don't do speculative/out-of-order execution. The only more recent hardware I've seen that's immune are the Raspberry Pi (in-order-execution) and some ARM hardware such as various Snapdragon or Cortex-A53/55. Some of the older Atom stuff is also safe because it doesn't do OOE, but Spectre will hit the majority of the rest.
Meltdown was quite certainly an Intel thing according all legit sources. It seem part of Intel's PR machine that somehow managed to group the two together even though they're quite separate vulnerabilities with quite different risk and effect factors.
The changes are deep in the OS kernel, hence whether AMD has the bug or not it IS AFFECTED. regardless while they aren't affected by meltdown they are vulnerable to spectre which is also fixed in the patch
the company stopped the rollout for AMD-based computers on January 9 after users reported crashes that plunged PCs into unbootable states.
One (of many) reasons why forced updates are a bad idea. Time to go back to Windows 7, which doesn't have forced updates, until Microsoft/AMD get their shit together and can issue patches that don't fuck up your computer.
So is the title flamebait, as is usual for our new Slashdot overlords?
Not just Slashdot. From TFA, on Bleeping Computer: Microsoft has resumed the rollout of security updates for AMD devices. The updates patch the Meltdown and Spectre vulnerabilities.
Then, later in TFA: The Meltdown flaw does not affect AMD devices, but these updates include an OS-level patch for the Spectre flaw.
Proofreading is apparently becoming, or already has become, a lost art.
I have all of my computers (all with AMD and all with Windows 7) set up to tell me about updates but let me decide which ones and when to install them.
If they had been set up to automatically update, at least one, or all of them, would have been stuck by now. I can't imagine the fear of living with Windows 10, never knowing when the next automatic update will brick your computer. Or being right in the middle of something important, like work, and having the computer decide that this would be a nice time to update. No, thank you, Microsoft.
So far I haven't seen the new update listed. I think I'll still let other users go first before I risk it.
Well, not really. But what's Microsoft going to do about all of the AMD systems it already bricked with its flawed patches?
all you who have an AMD CPU can just relax.
Let me repeat: spectre doesn't need patching - it cannot be practically used for exploits.
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
But how are they going to test their patches for their paying customers without the guinea pigs that don't have the money to sue?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Would you bet your money on that claim? It would not be the first "oh that cannot possibly be exploited in a real life scenario" bug that turned into a nightmare when someone with lots of creativity and criminal energy went to work.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The 2 Specter variants are just theoretical. It is just Intel FUD.To distract he public from what a nightmare Meltdown truly is to Intel.
I am in fact doing that. You know why? Because I can read, and I use that ability to collect information. For instance, I collected information about Spectre.
Try it sometimes.
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
My understanding is that AMD is theroretically vulnerable to hard to mitigate spectre (version 2?), But the proof of concept didn't work on it and AMD says it's super improbable. Certainly that warrents mitigation though.
Other Spectre easy to fix is easy to fix (version 1?).
And AMD is immune to meltdown.
Please correct me where I'm wrong, there's a lot of FUD and also a lot of super "AMD is immune" nonsense.
As it is, there is no proof of concept for hard to fix spectre on AMD.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
Many of the worst malware in the last two decades started with vulnerabilities that were announced as theoretical!
There's nothing theoretical about it. All three bugs had working proof of concepts published on the day of release.
It didn't help that the same people reported both vulnerabilities at the same time in regards to clarity. Let's call it unfortunate that both vulnerabilities are always lumped together. Meltdown is caused by a massive design flaw of Intel processors. I think Intel should replace all affected processors at no charge and cover the expenses to make hardware replacements. Instead they hand out patches that to a varying degree cripple performance. Nice going after folks already overpaid. Intel used to be only expensive, now it is expensive and crappy...just like Apple.
Most of us define a modern chip as one with a modern processor (processors) and modern is generally one with out of order execution.
The main advantage of OoO execution is enabling speculation where instructions that can't be guaranteed to be executed in the future _but_ are likely to be are allowed to begin execution.
This means things that would stall (=halt execution) a processor with no speculation can be bypassed which greatly increases the performance of the design, if the instruction is later detected to be wrongly executed the processor erases anything dependent on it and restarts on the right path.
Spectre and Meltdown both take advantage of the fact that while architectural state (what the programmer should see) isn't the same as the micro-architectural state including what is stored in caches (not architectural in the majority of designs). Thus the result of speculative execution can sometimes be read in the micro-architectural state via e.g. timing of cache misses/hits.
But note that modern processor cores that doesn't support OoO execution still generally have limited speculative execution and can in theory be susceptible to Spectre - I don't know of any example.
TL;DR Spectre does indeed attack pretty much anything modern as in having used modern designs.
That makes no sense. Your computer privileges have been revoked for being an idiot.