4 ms·

It's worth noting that Windows Update may also fail to apply the Meltdown/Spectre patch if other conditions aren't met. Some are mentioned on the KB page [1] bu

It's worth noting that Windows Update may also fail to apply the Meltdown/Spectre patch if other conditions aren't met. Some are mentioned on the KB page [1] but they don't mention another common scenario, which is that if your system firmware is not ready to accept the update, Windows Update will not apply it, and _it won't tell you_ that it's not applying it -- it will simply say 'Your device is up to date'. I had to dig around to find a page [2] that had some useful instructions allowing me to find out what the actual status of my Windows install was. I'm grateful to the author of that page, they provided critical info that neither Microsoft nor my machine's manufacturer did. I wish I could say that it boggles my mind that they could be so hushmouthed on the subject of a vulnerability this severe. Of course, my OEM (Lenovo) has not released an update for my Windows laptop (Yoga 900) since 2016, and as of today their support page [3] on Meltdown/Spectre does not indicate that they plan to do so. I'm posting this partly in anger/despair, partly in the hope that I'm wrong and that someone will pop up to comment and tell me there's a fix. There is a Linux BIOS for this machine but it's old and I don't know if it will actually address this issue. [1] https://support.microsoft.com/en-us/help/4056892/windows-10-update-kb4056892 https://support.microsoft.com/en-us/help/4056892/windows-10-... [2] https://www.bleepingcomputer.com/news/security/list-of-meltdown-and-spectre-vulnerability-advisories-patches-and-updates/ https://www.bleepingcomputer.com/news/security/list-of-meltd... [3] https://support.lenovo.com/us/en/solutions/len-18282 https://support.lenovo.com/us/en/solutions/len-18282

Arnavion 9y ago
>It's worth noting that Windows Update may also fail to apply the Meltdown/Spectre patch if other conditions aren't met. >... if your system firmware is not ready to accept the update, Windows Update will not apply it, and _it won't tell you_ that it's not applying it -- it will simply say 'Your device is up to date'. The update enables mitigations for Meltdown regardless of firmware. You need updated firmware for updated CPU microcode to mitigate Spectre. >I had to dig around to find a page [2] that had some useful instructions allowing me to find out what the actual status of my Windows install was. All this is transparently revealed when you run `Get-SpeculationControlSettings`, which is mentioned in the update guidelines, eg https://support.microsoft.com/en-us/help/4073119/ https://support.microsoft.com/en-us/help/4073119/
Karnickel 9y ago
I know I won't get any updates for the system for my 2012 Dell XPS 8500 (256 GB SSD, 16 GB RAM, i7 CPU - I don't see a need for an upgrade, it's all there). Does that mean I'll just be left out cold? That's how I understand it. When I run the Microsoft Powershell plugin that they made available to check the protection status (`Get-SpeculationControlSettings`) I get a "True" for 3 of 8 items (only showing those 3): Windows OS support for branch target injection mitigation is present: True Windows OS support for kernel VA shadow is present: True Windows OS support for kernel VA shadow is enabled: True
- mey 9y ago
  Same boat for my XPS 8700, also kept around for same reason. 24gb ram i7 4th gen. Great for development, including VM work. Unless I was regularly doing video transcoding or heavy CAD work, it's more than fast enough. Contacted Dell support and confirmed they will not be releasing a BIOS update for the system. First harm to me from this issue. Not sure if it means I will have to join a class action against Dell or Intel
  - ac29 9y ago
    Might want to check again tomorrow. My Dell Desktop (Ivy Bridge/3rd Gen era) received a BIOS update today, specifically noting "Update to the latest CPU microcode to address CVE-2017-5715." It updates the ME firmware too for those recent bugs.
    - mey 9y ago
      Thanks for the heads, I'll keep an eye out, but it's not listed on the following consumer systems list http://www.dell.com/support/article/us/en/19/sln308587/microprocessor-side-channel-vulnerabilities--cve-2017-5715--cve-2017-5753--cve-2017-5754---impact-on-dell-products?lang=en http://www.dell.com/support/article/us/en/19/sln308587/micro...
Jare 9y ago
My laptop spent a few days spinning the fans and consuming bandwidth, repeatedly downloading, trying and failing to install this patch. Error code was different from the KB article, but I followed instructions anyway, downloaded manually and ran it and it worked fine.
newman314 9y ago
There's a lot of confusing information out there as you have found out. This link helps clarify the steps needed. https://doublepulsar.com/important-information-about-microsoft-meltdown-cpu-security-fixes-antivirus-vendors-and-you-a852ba0292ec https://doublepulsar.com/important-information-about-microso... Pay specific attention to the dataflow. Registry keys have to be set in a certain order in order for a) the patch to download and install and b) actually enable. If there is not a BIOS fix (I'm in the same boat as you), the other hope is that the OS or virtualization provider includes CPU microcode in their update to address this. At this time, I do not believe Microsoft has included microcode in their current update. However, they do have the capability so that's something you can ask them about doing so at some point.
- Santosh83 9y ago
  Seems like Intel has released updated microcode: https://news.ycombinator.com/item?id=16111433 https://news.ycombinator.com/item?id=16111433 but sadly no mention of what Windows users are supposed to do.
  - newman314 9y ago
    At this time, nothing other than update BIOS. My Windows systems are VMs so I updated to the latest ESXI release (as of yesterday) which includes microcode. See https://www.vmware.com/us/security/advisories/VMSA-2018-0004.html https://www.vmware.com/us/security/advisories/VMSA-2018-0004...

Arnavion 9y ago

>It's worth noting that Windows Update may also fail to apply the Meltdown/Spectre patch if other conditions aren't met. >... if your system firmware is not ready to accept the update, Windows Update will not apply it, and _it won't tell you_ that it's not applying it -- it will simply say 'Your device is up to date'. The update enables mitigations for Meltdown regardless of firmware. You need updated firmware for updated CPU microcode to mitigate Spectre. >I had to dig around to find a page [2] that had some useful instructions allowing me to find out what the actual status of my Windows install was. All this is transparently revealed when you run `Get-SpeculationControlSettings`, which is mentioned in the update guidelines, eg https://support.microsoft.com/en-us/help/4073119/ https://support.microsoft.com/en-us/help/4073119/

Karnickel 9y ago

I know I won't get any updates for the system for my 2012 Dell XPS 8500 (256 GB SSD, 16 GB RAM, i7 CPU - I don't see a need for an upgrade, it's all there). Does that mean I'll just be left out cold? That's how I understand it. When I run the Microsoft Powershell plugin that they made available to check the protection status (`Get-SpeculationControlSettings`) I get a "True" for 3 of 8 items (only showing those 3): Windows OS support for branch target injection mitigation is present: True Windows OS support for kernel VA shadow is present: True Windows OS support for kernel VA shadow is enabled: True

mey 9y ago
Same boat for my XPS 8700, also kept around for same reason. 24gb ram i7 4th gen. Great for development, including VM work. Unless I was regularly doing video transcoding or heavy CAD work, it's more than fast enough. Contacted Dell support and confirmed they will not be releasing a BIOS update for the system. First harm to me from this issue. Not sure if it means I will have to join a class action against Dell or Intel
- ac29 9y ago
  Might want to check again tomorrow. My Dell Desktop (Ivy Bridge/3rd Gen era) received a BIOS update today, specifically noting "Update to the latest CPU microcode to address CVE-2017-5715." It updates the ME firmware too for those recent bugs.
  - mey 9y ago
    Thanks for the heads, I'll keep an eye out, but it's not listed on the following consumer systems list http://www.dell.com/support/article/us/en/19/sln308587/microprocessor-side-channel-vulnerabilities--cve-2017-5715--cve-2017-5753--cve-2017-5754---impact-on-dell-products?lang=en http://www.dell.com/support/article/us/en/19/sln308587/micro...

Jare 9y ago

My laptop spent a few days spinning the fans and consuming bandwidth, repeatedly downloading, trying and failing to install this patch. Error code was different from the KB article, but I followed instructions anyway, downloaded manually and ran it and it worked fine.

newman314 9y ago

There's a lot of confusing information out there as you have found out. This link helps clarify the steps needed. https://doublepulsar.com/important-information-about-microsoft-meltdown-cpu-security-fixes-antivirus-vendors-and-you-a852ba0292ec https://doublepulsar.com/important-information-about-microso... Pay specific attention to the dataflow. Registry keys have to be set in a certain order in order for a) the patch to download and install and b) actually enable. If there is not a BIOS fix (I'm in the same boat as you), the other hope is that the OS or virtualization provider includes CPU microcode in their update to address this. At this time, I do not believe Microsoft has included microcode in their current update. However, they do have the capability so that's something you can ask them about doing so at some point.

Santosh83 9y ago
Seems like Intel has released updated microcode: https://news.ycombinator.com/item?id=16111433 https://news.ycombinator.com/item?id=16111433 but sadly no mention of what Windows users are supposed to do.
- newman314 9y ago
  At this time, nothing other than update BIOS. My Windows systems are VMs so I updated to the latest ESXI release (as of yesterday) which includes microcode. See https://www.vmware.com/us/security/advisories/VMSA-2018-0004.html https://www.vmware.com/us/security/advisories/VMSA-2018-0004...