5 ms·

What I'd like to know is how effective are these OS updates (both Linux and Windows) without the associated firmware updates through microcode or BIOS/UEFI flas

What I'd like to know is how effective are these OS updates (both Linux and Windows) without the associated firmware updates through microcode or BIOS/UEFI flashing. My system is a few years old and I don't expect the OEM to release BIOS/UEFI updates for this model. Will the OS/microcode update still at least partially protect me or will I have to be super-paranoid about apps and javascript for the remainder of this machine's life? BTW, my machine is just a normal desktop/laptop, so no server stuff running or expected.

bhauer 9y ago
I share your concern. Based on my admittedly loose understanding, although the Spectre vulnerability is "more difficult" to exploit, I suspect it's a matter of time before exploits become more common. And the Spectre vulnerability is the one that requires a BIOS/firmware update. So that's a bit alarming for me since at least one of my several workstations is using a 5+ year old desktop board (an Intel board, ironically) that has been end-of-lifed according to its BIOS downloads support page. Meanwhile, some of the bigger server motherboard vendors (e.g., SuperMicro) are not yet prepared to supply firmware updates for recent motherboards. Recognizing that the operating system vendors/maintainers are not responsible for our systems' BIOS and hardware, the flippant advice to "talk with your device's vendor" gives me a sinking feeling. (E.g., Microsoft: "Consult with the device manufacturer about the firmware version that has the appropriate update for your CPU.") As a technical person, I am going to find it difficult to bring all of my hardware—especially the older hardware—up to snuff for coping with these vulnerabilities. I fear for people who are less technically inclined.
- cthalupa 9y ago
  >And the Spectre vulnerability is the one that requires a BIOS/firmware update. One of the Spectre variants. The other isn't mitigated by it and will require an lfence on your sensitive areas of apps.
  - moe 9y ago
    This is a key detail that gets glossed over too much for my liking. No OS or Firmware update will fully fix Spectre. All applications that interpret untrusted code (such as Web browsers) also have to be patched. https://gist.github.com/woachk/2f86755260f2fee1baf71c90cd6533e9 https://gist.github.com/woachk/2f86755260f2fee1baf71c90cd653...
- rhizome 9y ago
  So that's a bit alarming for me since at least one of my several workstations is using a 5+ year old desktop board (an Intel board, ironically) that has been end-of-lifed according to its BIOS downloads support page Buy stock in Gigabyte, MSI, etc.
- danieldk 9y ago
  Microcode updates can be applied on boot through the BIOS/EFI firmware, but also by the operating system. Linux (I don't know about Windows) has facilities to update the microcode on boot: https://wiki.archlinux.org/index.php/microcode https://wiki.archlinux.org/index.php/microcode https://wiki.debian.org/Microcode https://wiki.debian.org/Microcode Also, directly from Intel: While the regular approach to getting this microcode update is via a BIOS update, Intel realizes that this can be an administrative hassle. The Linux operating system has a mechanism to update the microcode after booting. For example, this file will be used by the operating system mechanism if the file is placed in the /etc/firmware directory of the Linux system. Source: https://downloadcenter.intel.com/download/27337/Linux-Processor-Microcode-Data-File https://downloadcenter.intel.com/download/27337/Linux-Proces... Apple probably delivers them through EFI updates, but of course, getting updated EFI firmware from Apple was never a problem.
chomp 9y ago
Only kinda effective. Retpoline on Skylake and later isn't completely reliable as a mitigation for one of the spectre variants, and IBRS is one of the processor features that will supposedly correct that. You'll still be vulnerable, it'll just add another layer of difficulty to the exploit.
JdeBP 9y ago
The microcode updates that people have been mentioning are not updates to your motherboard's firmware, EFI or otherwise. They are updates to the code that runs inside your central processor chip, the so-called microcode, that does the work of understanding and enacting processor instructions (in all programs, from the programs in your firmware to the programs that you download and run from the WWW). Firmware updates are largely irrelevant to this issue, only being involved in the sense that one way to perform microcode updates is for your machine's firmware to upload the new microcode image file. But that is just one way for that to be done; your operating system can do it, too. * http://inertiawar.com/microcode/ http://inertiawar.com/microcode/ * https://news.ycombinator.com/item?id=16081366 https://news.ycombinator.com/item?id=16081366 * https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf https://newsroom.intel.com/wp-content/uploads/sites/11/2018/... (https://news.ycombinator.com/item?id=16079910 https://news.ycombinator.com/item?id=16079910)
- frik 9y ago
  As I understand the microcode updates get installed by Linux distros and Windows by updates. Microcodes are loaded by the CPU at every boot. The question is, how can one check if the CPU already got the microcode update? Can a OS running inside a VM (over Intel VT ring-1) patch the CPU's microcode? (e.g. Linux host, and Win guest patches CPU's microcode) Nothing seems impossible anymore.
- _wmd 9y ago
  AFAIK on Intel it's not possible to load a microcode update over the top of one already loaded by your firmware, so if the firmware shipped an older update, the firmware really needs to be updated. (Please someone correct me if this isn't the case -- I can't even remember where I read this)
  - wilun 9y ago
    I don't think this is correct at all. I've personally seen the contrary happening. EDIT: however for some rare features, it is preferable to have them loaded by the firmware. I don't know if this is the case here.
mjevans 9y ago
If you're running a Windows machine, I've no idea how it handles the microcode updates. For LINUX (and probably BSD/etc users): https://wiki.archlinux.org/index.php/microcode#Enabling_Intel_microcode_updates https://wiki.archlinux.org/index.php/microcode#Enabling_Inte... Your distribution probably has a firmware package that has this bootloader stub. It applies the latest microcode updates just before your OS actually begins starting up (but for Linux after the Kernel has initialized things and is preparing to hand off to the initrd). Yes, this is something that needs to happen at every boot; they don't get burned in to the CPU.
- pqh 9y ago
  I downloaded the microcode updates from Intel, but hesitate to apply them because one of the expected directories does not exist on Manjaro, so I'm out of my element on how supported the update would be. Do you happen to know if in general microcode updates are distributed in packages? It seems that's probably the case, and if so, I'm fine waiting.

bhauer 9y ago

I share your concern. Based on my admittedly loose understanding, although the Spectre vulnerability is "more difficult" to exploit, I suspect it's a matter of time before exploits become more common. And the Spectre vulnerability is the one that requires a BIOS/firmware update. So that's a bit alarming for me since at least one of my several workstations is using a 5+ year old desktop board (an Intel board, ironically) that has been end-of-lifed according to its BIOS downloads support page. Meanwhile, some of the bigger server motherboard vendors (e.g., SuperMicro) are not yet prepared to supply firmware updates for recent motherboards. Recognizing that the operating system vendors/maintainers are not responsible for our systems' BIOS and hardware, the flippant advice to "talk with your device's vendor" gives me a sinking feeling. (E.g., Microsoft: "Consult with the device manufacturer about the firmware version that has the appropriate update for your CPU.") As a technical person, I am going to find it difficult to bring all of my hardware—especially the older hardware—up to snuff for coping with these vulnerabilities. I fear for people who are less technically inclined.

cthalupa 9y ago
>And the Spectre vulnerability is the one that requires a BIOS/firmware update. One of the Spectre variants. The other isn't mitigated by it and will require an lfence on your sensitive areas of apps.
- moe 9y ago
  This is a key detail that gets glossed over too much for my liking. No OS or Firmware update will fully fix Spectre. All applications that interpret untrusted code (such as Web browsers) also have to be patched. https://gist.github.com/woachk/2f86755260f2fee1baf71c90cd6533e9 https://gist.github.com/woachk/2f86755260f2fee1baf71c90cd653...
rhizome 9y ago
So that's a bit alarming for me since at least one of my several workstations is using a 5+ year old desktop board (an Intel board, ironically) that has been end-of-lifed according to its BIOS downloads support page Buy stock in Gigabyte, MSI, etc.
danieldk 9y ago
Microcode updates can be applied on boot through the BIOS/EFI firmware, but also by the operating system. Linux (I don't know about Windows) has facilities to update the microcode on boot: https://wiki.archlinux.org/index.php/microcode https://wiki.archlinux.org/index.php/microcode https://wiki.debian.org/Microcode https://wiki.debian.org/Microcode Also, directly from Intel: While the regular approach to getting this microcode update is via a BIOS update, Intel realizes that this can be an administrative hassle. The Linux operating system has a mechanism to update the microcode after booting. For example, this file will be used by the operating system mechanism if the file is placed in the /etc/firmware directory of the Linux system. Source: https://downloadcenter.intel.com/download/27337/Linux-Processor-Microcode-Data-File https://downloadcenter.intel.com/download/27337/Linux-Proces... Apple probably delivers them through EFI updates, but of course, getting updated EFI firmware from Apple was never a problem.

chomp 9y ago

Only kinda effective. Retpoline on Skylake and later isn't completely reliable as a mitigation for one of the spectre variants, and IBRS is one of the processor features that will supposedly correct that. You'll still be vulnerable, it'll just add another layer of difficulty to the exploit.

JdeBP 9y ago

The microcode updates that people have been mentioning are not updates to your motherboard's firmware, EFI or otherwise. They are updates to the code that runs inside your central processor chip, the so-called microcode, that does the work of understanding and enacting processor instructions (in all programs, from the programs in your firmware to the programs that you download and run from the WWW). Firmware updates are largely irrelevant to this issue, only being involved in the sense that one way to perform microcode updates is for your machine's firmware to upload the new microcode image file. But that is just one way for that to be done; your operating system can do it, too. * http://inertiawar.com/microcode/ http://inertiawar.com/microcode/ * https://news.ycombinator.com/item?id=16081366 https://news.ycombinator.com/item?id=16081366 * https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf https://newsroom.intel.com/wp-content/uploads/sites/11/2018/... (https://news.ycombinator.com/item?id=16079910 https://news.ycombinator.com/item?id=16079910)

frik 9y ago
As I understand the microcode updates get installed by Linux distros and Windows by updates. Microcodes are loaded by the CPU at every boot. The question is, how can one check if the CPU already got the microcode update? Can a OS running inside a VM (over Intel VT ring-1) patch the CPU's microcode? (e.g. Linux host, and Win guest patches CPU's microcode) Nothing seems impossible anymore.
_wmd 9y ago
AFAIK on Intel it's not possible to load a microcode update over the top of one already loaded by your firmware, so if the firmware shipped an older update, the firmware really needs to be updated. (Please someone correct me if this isn't the case -- I can't even remember where I read this)
- wilun 9y ago
  I don't think this is correct at all. I've personally seen the contrary happening. EDIT: however for some rare features, it is preferable to have them loaded by the firmware. I don't know if this is the case here.

mjevans 9y ago

If you're running a Windows machine, I've no idea how it handles the microcode updates. For LINUX (and probably BSD/etc users): https://wiki.archlinux.org/index.php/microcode#Enabling_Intel_microcode_updates https://wiki.archlinux.org/index.php/microcode#Enabling_Inte... Your distribution probably has a firmware package that has this bootloader stub. It applies the latest microcode updates just before your OS actually begins starting up (but for Linux after the Kernel has initialized things and is preparing to hand off to the initrd). Yes, this is something that needs to happen at every boot; they don't get burned in to the CPU.

pqh 9y ago
I downloaded the microcode updates from Intel, but hesitate to apply them because one of the expected directories does not exist on Manjaro, so I'm out of my element on how supported the update would be. Do you happen to know if in general microcode updates are distributed in packages? It seems that's probably the case, and if so, I'm fine waiting.