Microsoft Issues Windows Out-of-Band Update That Disables Spectre Mitigations (bleepingcomputer.com)

An anonymous reader quotes BleepingComputer: Microsoft has issued on Saturday an emergency out-of-band Windows update that disables patches for the Spectre Variant 2 bug (CVE-2017-5715). The update -- KB4078130 -- targets Windows 7 (SP1), Windows 8.1, all versions of Windows 10, and all supported Windows Server distributions. Microsoft shipped mitigations for the Meltdown and Spectre bugs on January 3. The company said it decided to disable mitigations for the Spectre Variant 2 bug after Intel publicly admitted that the microcode updates it developed for this bug caused "higher than expected reboots and other unpredictable system behavior" that led to "data loss or corruption."

HP, Dell, and Red Hat took previous steps during the past week.
"We are also offering a new option -- available for advanced users on impacted devices -- to manually disable and enable the mitigation against Spectre Variant 2 (CVE 2017-5715) independently via registry setting changes..." Microsoft writes.

"We recommend Windows customers, when appropriate, reenable the mitigation against CVE-2017-5715 when Intel reports that this unpredictable system behavior has been resolved for your device. "

Comments

So Linus was right?

[Anonymous Coward]

Basically they are telling us that Linus was not overreacting...
This is what happens when the market is a monopoly, Intel sitting at its laurels, without a care in the world it seems...

New processor for everyone!

[mspohr]

If it's so easy to disable the protection in a Microsoft patch, I'm sure that anyone who wants to exploit the microcode bug could also disable the protection.
This is a fundamental flaw with the microcode and the only fix is a new processor.
Intel needs to give everyone a new processor or motherboard... (and a pony).

Re:New processor for everyone!

[wonkey_monkey]

If it's so easy to disable the protection in a Microsoft patch, I'm sure that anyone who wants to exploit the microcode bug could also disable the protection.

Your use of the phrase "I'm sure" leads me to suspect that you're not in any way sure about this.

Re:New processor for everyone!

[user32.ExitWindowsEx]

WTF?
If you can climb all the way to registry-editing admin, why would you waste that trying to disable an update that prevents you from merely reading memory?
You *ALREADY* owned the box to the point where you could load a custom kernel driver and simply sniff everyone's memory through that at full speed.

Re:New processor for everyone!

[Anne Thwacks]

If Microsoft can disable the patch. I am sure that even below average hackers can disable the patch.

FTFY

Re:Odd, I run Win7 64-bit & see no such bs...

[AmiMoJo]

It's probably your massive hosts file causing buffer overflows.

So, how is this forced update thing working out?

[CptLoRes]

Being on Windows 7 I am still given the choice when to apply any updates. And so I made a decision to not install ANY Meltdown or Spectre related updates until the dust settles. So far it seem to have been the right choice.

Can someone *please*

[Chris Mattern]

teach Microsoft what "Out of Band" means? Hint--it doesn't mean "unscheduled."

Re:Can someone *please*

[Carewolf]

teach Microsoft what "Out of Band" means? Hint--it doesn't mean "unscheduled."

Actually a "band" in this context is a specific radio frequency, and "out-of-band" is things not on that specific frequency. So if MS has a frequency of updates, something outside that frequency is out-of-band.

Software should just give up on Spectre

[jader3rd]

There's no point in trying to patch Spectre. Patching Meltdown I get, but Spectre such a pain, it will take hardware fulfilling its side of the process isolation agreement\understanding.

Re:Software should just give up on Spectre

[Ramze]

I tend to agree. Meltdown had an obvious path to exploit -- run an unauthorized branch of code to access something one shouldn't, then make sure another bit of code read that unauthorized data before it was flagged and wiped. Spectre.... it's just snooping on random processes hoping to find something interesting at the same user-level access.

In a jewelry store theft comparison:

Meltdown -- walk in as a celebrity, ask the jeweler if you can view a specific priceless ring that only celebrities could afford, and then you bolt for the door as soon as the ring is on your finger. You got exactly what you wanted.

Spectre -- walk in, try to grab any ring an average customer is presently inspecting... assuming there are any customers and any of them are viewing any rings during your visit. You have no idea what you're going to get, if anything.... but whatever you DO get, it won't be the specific ring in Meltdown you could have gotten.

Re:So, how is this forced update thing working out

[SeaFox]

On 8.1 here, and I'm going to do the same thing.

In fact I'm not sure I will ever run Windows 10. I'm on the tail end of my system (Core i7 920)'s life, so I could build my next system and just install Linux Mint. Or maybe I'll get a Mac desktop to go with my (mid 2010) MacBook I have for a laptop.

Re:Odd, I run Win7 64-bit & see no such bs...

[fisted]

Why would you patch Windows XP? It's not like it's still in heavy use, there's no point. Only ATMs, POS, medical and industrical equipment, really who cares.

DeepAPK

[DrYak]

Somewhere, someone is training some "Deep-Trump"-like deep neural net on APK's corpus of bullshit, and is ready to generate entire discussion trees of APK-"deep"-impostors all shouting at each-other...

Re:So, how is this forced update thing working out

[Anne Thwacks]

Anyone know when that will be?

A couple of centuries after hell freezes over.