Slashdot Mirror
Microsoft's 'Meltdown' Patch For Windows 10 Contains a Fatal Flaw (bleepingcomputer.com)
An anonymous reader quotes BleepingComputer: Microsoft's patches for the Meltdown vulnerability have had a fatal flaw all these past months, according to Alex Ionescu, a security researcher with cyber-security firm Crowdstrike. Only patches for Windows 10 versions were affected, the researcher wrote today in a tweet. Microsoft quietly fixed the issue on Windows 10 Redstone 4 (v1803), also known as the April 2018 Update, released on Monday.
"Welp, it turns out the Meltdown patches for Windows 10 had a fatal flaw: calling NtCallEnclave returned back to user space with the full kernel page table directory, completely undermining the mitigation," Ionescu wrote. Ionescu pointed out that older versions of Windows 10 are still running with outdated and bypass-able Meltdown patches.
Wednesday Microsoft issued a security update, but it wasn't to backport the "fixed" Meltdown patches for older Windows 10 versions. Instead, the emergency update fixed a vulnerability in the Windows Host Compute Service Shim (hcsshim) library (CVE-2018-8115) that allows an attacker to remotely execute code on vulnerable systems.
"Welp, it turns out the Meltdown patches for Windows 10 had a fatal flaw: calling NtCallEnclave returned back to user space with the full kernel page table directory, completely undermining the mitigation," Ionescu wrote. Ionescu pointed out that older versions of Windows 10 are still running with outdated and bypass-able Meltdown patches.
Wednesday Microsoft issued a security update, but it wasn't to backport the "fixed" Meltdown patches for older Windows 10 versions. Instead, the emergency update fixed a vulnerability in the Windows Host Compute Service Shim (hcsshim) library (CVE-2018-8115) that allows an attacker to remotely execute code on vulnerable systems.
it's not a subscription..... yet.
remember how microsoft said that windows 10 would be "the last windows you'll ever buy"?
it's absolutely true, because the next version will be exactly that... a rammed-up-your-ass subscription... for everybody, not just 'enterprise' users.
they're following the cable tv model. shrinking market (thanks to mobile devices and stagnant pc sales instead of cord cutting for cable), so start abusing the fuck out of the customers that are left, wringing every last drop of profits possible before their entire business model collapses into a black hole.
I think Microsoft views disabling servers as less worse than leaving them with a security problem. Just sucks for us since my company's web site is down after apply new Microsoft updates. I'm probably going to lose my job over this which sucks, but I did put in writing in an email that our staging systems wouldn't boot after installing the latest Windows updates.
I wish we stayed with the WIndows 7 model, where a purchase meant a purchase not a subscription.
I haven't yet seen a monthly bill for my copy of Windows. People keep mistaking the new Windows model as some radical departure, which it really is not. All it means is that Microsoft is doing away with UPGRADE purchases. You're still required to purchase a new copy of Windows if you buy a new computer.
You get a license for the lifetime of the computer, not your lifetime. So, it's really not as different in reality as "the last version of Window" sounds. I think Microsoft just realized that most consumers didn't purchase upgrades anyhow (only "upgrading" when a new computer was purchased), and maintaining several OS lines at the same time was a pain, so in reality, it's more of a cost-saving measure for them by simply keeping everyone on the same branch of Windows.
Irony: Agile development has too much intertia to be abandoned now.
Indeed. As to playing media, VLC works pretty well, I don't think I have used the WMC in years. (I am still on Win 7 and preparing to move everything except gaming to Linux when Win10 cannot be avoided anymore...)
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Microsoft's downfall began when they fired most of their QA staff.
Everything has gone to shit since.
http://www.businessinsider.com...
Satya Nadella has fucked things up, but it's not too late to fire him.