back to article Microsoft patches Windows to cool off Intel's Meltdown – wait, antivirus? Slow your roll

Microsoft has released updates for Windows to block attempts by hackers and malware to exploit the Meltdown vulnerability in Intel x86-64 processors – but you will want to check your antivirus software before applying the fixes. The Redmond giant issued the out-of-band update late yesterday for Windows 10 version 1709. While …

  1. hellwig

    McAfee?

    My employer uses McAfee, so I assume we must already be patched and ready to go. I feel so secure.

    Find out how you can make US 10.000$ a week working from home Visit $URL;> to find out more.

    1. AndrueC Silver badge
      Joke

      Re: McAfee?

      I'm still using the free copy of Kaspersky Barclays let me have. So I'm safe from everyone except the Russian government.

      1. TechnicalBen Silver badge
        Joke

        Re: McAfee?

        Is that the Windows 95 copy you have running on your Vista system then?

      2. MrReal

        Re: McAfee?

        LOL, at least you'll be safe from the US government and it's 17 security agencies, who it must be said SHOULD HAVE SPOTTED THIS BUG.

        So we have to conclude that either

        1. They did spot it but kept quiet and abused it to spy on people

        or

        2. They are incompetent and useless.

        Neither of which is very confidence inspiring and none have anything to do with Russia...

    2. Anonymous Coward
      Thumb Up

      Re: McAfee?

      You're fine with McAfee - it slugs the CPU so much that the branch predictor gives up and goes home.

      1. TechnicalBen Silver badge
        Joke

        Re: McAfee?

        McAfee runs on the CPU?! At the speed I've seen, I thought it was dialling out on the HDD activity LED waiting for stray cosmic rays to flip it's bits over to the next step in the code...

        1. Prst. V.Jeltz Silver badge

          Re: McAfee?

          I've just looked in task manager, I have 15 process running with a mcaffee badge.

          including a "Canary Process"

          Also I have 1 Chrome window with 5 tabs. This means 9 chrome processes want to run!

  2. Anonymous Coward
    Anonymous Coward

    I've got an idea!

    Why don't they just make it not crash, without requiring a registry value being set?

    1. psychonaut

      or, just automatically set the reg value before it runs the update?

      1. Anonymous Coward
        Anonymous Coward

        The point of the brand new reg value

        Is that only shiny new anti-virus software with updated shitty dependencies on Windows internal gubbins knows to set it. The absence of the value suggests that old anti-virus is present, which will probably kick the patched Windows in the 'nads.

        1. psychonaut

          Re: The point of the brand new reg value

          yeah, but win security centre knows what av is installed for most major brands, hell, team viewer knows it. wouldn't be beyond the realms of mankind to check that automatically would it?

          1. Roland6 Silver badge

            Re: The point of the brand new reg value

            yeah, but win security centre knows what av is installed for most major brands, hell, team viewer knows it. wouldn't be beyond the realms of mankind to check that automatically would it?

            Well it would make sense on consumer systems for Win Security Centre to set the key, however, suspect there are valid installs where Win Security Centre isn't running or cannot reliability determine the AV software installed, hence MS have left it to the AV vendor to set.

            Because of the circumstances under which it blue screens, it is worth manually setting this and seeing if your 'old' AV causes a blue screen or not, as you can always delete the key via safe mode.

            1. psychonaut

              Re: The point of the brand new reg value

              i dont think im going to enable this on anything. trend reckon they have, in development, not released yet, an auto patch that can be installed via trend wfbs itself, but its not ready yet. i really dont fancy doing this on 746 machines manually....i hope to christ that they do it right...otherwise my phone will melt.

              if you use trend wfbs, see the below

              trend response

        2. Roland6 Silver badge

          Re: The point of the brand new reg value

          Is that only shiny new anti-virus software with updated shitty dependencies on Windows internal gubbins knows to set it.

          It must be really shiny and new AV software, as a machine currently running MBAM 30-day trial doesn't have this key...

          So just because you are running a current subscription AV doesn't mean this KB will be installed, you need to check that the key exists and then do the install.

          The absence of the value suggests that old anti-virus is present, which will probably kick the patched Windows in the 'nads.

          It also suggests that no AV is present.

  3. Richard Jones 1
    WTF?

    Huge Baby Huge

    The update is one mighty package it is slowly ticking by one percent at a time.

    1. noodle heimer

      Re: Huge Baby Huge

      Yes, it appears to be a rewrite of most of the core pieces of the Windows directory - I took a look around C:\Windows\SoftwareDistribution\Download once it downloaded, and have decided I'm willing to wait a few days to hear what other problems this behemoth causes.

      Contrary to what Intel is bleating about it, it looks to be all Windows components being patched. And an enormous and rather terrifying number of them, all patched at once.

      I dont' see anything that looks like a microcode update from Intel to address the root cause.

      1. Ken Hagan Gold badge

        Re: Huge Baby Huge

        So that's pretty much an "out-of-band new version of Windows" coming down the wire, eh?

        Well that's the internet fucked for a few days, then. Are the Linux patches similar?

        1. Ken Hagan Gold badge

          Re: Huge Baby Huge

          "Are the Linux patches similar?"

          To answer my own question, the only linux patch available for my Debian Stretch boxes right now is one for linux-image-amd64, so that's a big fat no. If there *are* plans to recompile all of user-space with Spectre mitigations, they aren't being put into effect yet.

          1. fandom

            Re: Huge Baby Huge

            why would they recompile all of user space to make the kernel use a separate virtual address space?

          2. Anonymous Coward
            Anonymous Coward

            "is one for linux-image-amd64, so that's a big fat no."

            Which tells you don't know what it is - it's a metapackage that will download the updated kernel through it dependencies. That package may be just a few kilobytes, but it could trigger the download of some hundred megabytes.

        2. Chemist

          Re: Huge Baby Huge

          " Are the Linux patches similar?"

          The OpenSUSE one was ~52MB download for kernel & just had a 2.6MB Intel u-code update. Don't know if there will be more.

          1. hayzoos

            Re: Huge Baby Huge

            In comparison to Windows, I would not expect Linux kernel patches to be huge, even if you include some critical system utilities require patching, systemd on the other hand . . .

      2. hplasm Silver badge
        Devil

        Re: Huge Baby Huge

        "Yes, it appears to be a rewrite of most of the core pieces of the Windows directory "

        For real this time?

        Not just "rewritten from the ground up" like all the New Versions?

        Blimey!

      3. Dave K Silver badge

        Re: Huge Baby Huge

        >> "I dont' see anything that looks like a microcode update from Intel to address the root cause."

        That's because Meltdown is beyond the scope of a microcode fix.

        As a result, the "fix" doesn't actually fix your CPU at all - it re-writes core parts of your OS so that the CPU flaw can no longer expose parts of kernel memory. That's why this fix involves lots of patched Windows files. Think of it more as a workaround than a resolution :)

        1. LDS Silver badge

          "Think of it more as a workaround than a resolution"

          Actually, even mapping kernel memory into a process address space - albeit protected by some access control bits - is a performance workaround to avoid the performance hit due to switching address spaces.

          From a security point of view, fully isolating the kernel memory from user processes is a much sounder design - not a workaround. The issue is CPU are not designed to switch them quickly, and anyway performing the required checks takes time.

          1. Simon Harris Silver badge

            Re: "Think of it more as a workaround than a resolution" @LDS

            It's a long time since I've had to read an Intel CPU data sheet.

            Was (prior to this) mapping kernel code into every application's virtual memory space their recommended way of calling kernel functions from an application for better performance, or did they advocate a proper separation and context switch?

            1. LDS Silver badge

              Re: "Think of it more as a workaround than a resolution" @LDS

              I don't really know if that was something suggested by Intel, or something devised by kernel developers to avoid bottlenecks. I think more about the latter, but I could be wrong.

              Some information about the use of the features that lead to this issues, and some of their possible solutions are in "Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 3A: System Programming Guide, Part 1".

              Intel has always suggested different models, but the more secure one implied the use of segments and specific "gates" to call across rings, which is very "heavy" and no one used - and in 64 bit mode AMD thought it was fine to get rid of segments. IMHO, one day they will find it's the right way to write secure OS.

              Anyway, today you'd need to read some long manuals, i.e. "Intel® 64 and IA-32 Architectures Optimization Reference Manual" (788 pages) or "Intel® 64 and IA-32 Architectures Software Developer Manual: Vol 3" (1998 pages), to have a good knowledge of all the available features and recommended use.

      4. Ken Hagan Gold badge

        Re: Huge Baby Huge

        "Contrary to what Intel is bleating about it, it looks to be all Windows components being patched. And an enormous and rather terrifying number of them, all patched at once."

        To be fair, *only* Intel are trying to pretend that this is a minor issue. Everyone else is talking about how unfixable Spectre is and how it can only be mitigated with counter-measures compiled into all software running on the system. Presumably, then, MS have simply run all of Windows through a version of the compiler that applies the mitigations. They've had 6 months to test such a compiler and they have a reproducible build system for all of Windows, so this isn't any more scary than a hobbyist rebuilding their own Linux system, which any competent software developer will tell you is not *very* scary.

      5. Hans 1 Silver badge

        Re: Huge Baby Huge

        Weird, apparently, since it should only need a "kernel" patch, like on Linux, few lines of code, done ... on Windows, they have to patch half the bloody binaries ? Ahhh, of course, that is because that half lives in kernel space, to speed up the monster ...

        1. LDS Silver badge
          Devil

          "that is because that half lives in kernel space, to speed up the monster ..."

          You should thank that decision now, less user/kernel switches and back, so less performance issues...

        2. Hans 1 Silver badge

          Re: Huge Baby Huge

          Here is a list of files: http://download.microsoft.com/download/D/A/0/DA052502-1178-41A0-83CF-7120155B2009/4056892.csv

          Yes, it includes Cortana "listen" ui ... what that has to do with Meldown is mystery!

      6. MrReal

        Re: Huge Baby Huge

        Huge - just like all Win10 patches then :D

        All with a rushed fix done with overtime by sleepy engineers.

        What could go wrong?

        I suspect all programs that ask for a password now explicitly now black the password string as soon as it's been used to stop it hanging around in memory - so more changes than just the kernel.

    2. PhillW

      Re: Huge Baby Huge

      If it is the Win 10 update, I checked its in excess of 900MB........ once upon a day that was about 3 O/S installs :-(

      900MB for an update............ wft?

  4. psychonaut

    too many beers already possibly, but...

    "Also, people installing the Windows Server patches should ensure they are enabled, too. They are disabled by default due to the potential performance hit involved. "

    "they" are enabled? what are enabled? wtf are you talking about?

    do you mean the mitgations talked about in the link on "they are enabled"? in which case, word it as "you should enable these mitigations here" or similar?

    1. Anonymous Coward
      Anonymous Coward

      not "what", but "who", i.e. the people installing the Windows Server patches, silly. Although I'd personally use the word "capable". Or "certified" ;)

      1. psychonaut

        that actually makes sense. I think I'm going to bed before i become fully enabled...

    2. hplasm Silver badge
      Coat

      Aha!

      "Also, people installing the Windows Server patches should ensure they are enabled, too. They are disabled by default due to the potential performance hit involved. "

      Discrimination!

  5. arctic_haze

    Mozilla also issued a patch

    There is a new Firefox (57.0.4) which makes some timings more random to allegedly make it more difficult to exploit the two bugs.

    I wonder how much slower Firefox becomes to protect itself from other processes I run on my personal computer. In theory the OS could eavesdrop Firefox, but it could be also done in many other ways.

    1. psychonaut

      Re: Mozilla also issued a patch

      can you imagine how much (more) ram chrome will eat if google do the same thing?

      1. 's water music Silver badge

        Re: Mozilla also issued a patch

        can you imagine how much (more) ram chrome will eat if google do the same thing?

        None more on my system. It has gobbled it all already

        1. psychonaut

          Re: Mozilla also issued a patch

          so the solution is simple....buy more ram!! ;)

    2. Anonymous Coward
      Anonymous Coward

      Re: Mozilla also issued a patch

      Edge also has done this, for the few that use it.

  6. Martleby

    Doesn't matter

    Unless your computer also has a firmware update you're not protected. And good luck getting that firmware update, unless you bought your PC from Dell in the last 6 months.

    1. Jim Mitchell

      Re: Doesn't matter

      Eh? CPU microcode updates can be done by the BIOS or the OS.

      1. Montreal Sean

        Re: Doesn't matter

        From what I recall there is no way to fix this problem through CPU microcode updates, so a lack of available BIOS updates is irrelevant.

        1. xenny

          Re: Doesn't matter

          There's a microcode component to the spectre mitigations. See https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf

  7. psychonaut

    just a heads up....i think this update has screwed trend wfbs. ive had 3 win 10 machines do odd things today on fresh installs - firewall wont enable on trend, refuses to start even from directly telling the service to start, and the enable firewall button is greyed out on the client. in services, a dependancy for the firewall service is missing, trend micro wfp callout driver, but i cant find this referenced with a fix anywhere.

    ive been scratching my head on this one. ive only got 1 machine left in the lab with this issue, but it has the update applied. i'll take it off and see what happens

    1. psychonaut

      fyi, didnt make any difference. a coincidence. a fucker of a coincidence, but one none the less. move along....

  8. Anonymous Coward
    Anonymous Coward

    My strategy

    I'm going to hold my breath...

    1. Anonymous Custard Silver badge
      Joke

      Re: My strategy

      So you're risking a BSOD too?

  9. MrT

    Meanwhile, on Windows 7...

    ... KB4056894 is causing BSODs (blue and black) on restart after installation. That's on W7Pro-64bit, with Microsoft Security Essentials installed. Okay, so not a stellar setup, but you'd think it would have the least hassle since it's all MS. It even gives different error codes in each crash (80242016, 800F0816, etc.) and a slightly different fix each time as well.

    KB4056894 is now blocked and hidden, because I've got better things to do than nurse borked laptops back to life each time it gets a toe-hold in.

    Will wait to see if the AV trick registry key works, but not yet.

    1. MrT

      Re: Meanwhile, on Windows 7...

      And I've just seen the 12/2017 version of the Quality Roll-up update arrive - KB4054518, but that's late (issued 12 December?).

      It's only 00:47 - I wonder if it fixes things...?

      Hmm, it hasn't broken anything, but I'll still hold off with the Jan 2018 one for now...

    2. MrT

      Re: Meanwhile, on Windows 7...

      ... KB4056894 is the Win7 version of KB4056892. The details of **94 state Security updates to Windows SMB Server, Windows Kernel, Microsoft Graphics Component, Internet Explorer, and Windows Graphics. The notes mention the same registry key details. **94 installs automatically, and leaves one laptop with a STOP error seconds after trying to start Windows.

      Solutions mostly involved the Windows Repair tool, which auto-recovered one time (2nd or 3rd), but required two system restores on a later fix, which is why the December Quality Roll-up reappeared - I'd applied that one late and restores after that date failed to stick.

      YMMV, but that's been my experience so far with this out of step patch.

      From a Meltdown perspective, it's an older laptop (Toshiba SatPro A300D) running an AMD Turion64 X2 CPU, and Radeon graphics. I haven't tried other Intel/Nvidia and Intel/Intel laptops yet, Win10 or Win7-32bit may also have a different ride, which might also be affected by the rest of my PCs running different AV - the A300D really stands apart from the others.

      1. MrT

        Re: Meanwhile, on Windows 7...

        Win7-32bit laptop on Intel CPU and discrete Nvidia GPU, with Zonealarm Extreme Security - **94 patch installed with no problems. ZA had set the registry entry itself.

        Win10-64bit laptop on Intel CPU and on board graphics, same ZA AV etc. doesn't list the **92 patch - registry key not set.

        YMMdefinitelyV - mine has, going from no probs to no go, passing not there, in just three laptops.

        1. MrT

          Re: Meanwhile, on Windows 7...

          KB4056892 now applied to the Win10 laptop, and has slowed disk br down to between half and fifth of what it used to be...

          Intel 1000M CPU (approx 4 years old), Win10-64bit, Crucial MX200 0.5TB, 8GB RAM.

          On the CrystalDiskMark v6 benchmark the results are between 15% and 60% of what they used to be, probably due to the way the drive caches R/W access through a chunk of system RAM. Subjectively, overall the PC feels more in the 70-95% estimated range from the article, but the workaround has definitely hit this PC's file I/O speed.

  10. Grade%

    Someone cue the goddamn carousel music.

    Please. Thanks. I'll bring enough voodoo rattles so everyone can get in on the dance.

    1. hplasm Silver badge
      Happy

      Re: Someone cue the goddamn carousel music.

      "Please. Thanks. I'll bring enough voodoo rattles so everyone can get in on the dance."

      Thanks! I'll bring the dead chickens from the Unix fridge.

  11. Brian Miller Silver badge

    Check Twitter for info??

    Check Twitter for updated info?? Might as well use Wikipedia as an authoritative reference.

    Oh wait...

  12. a_yank_lurker Silver badge

    Chipzilla it was nice to know you

    As bad as this cock up is I suspect there will a series of patches for all OSes that will be rushed more than normal. This is one time I will not criticize Slurp or anyone else for wonky patches to fix Chipzilla's screw up.

  13. Anonymous Coward
    Anonymous Coward

    No Mention of AVG!

    :-[

    I may dust off my pre-speculative execution PII 266 for browsing in future.

    1. Anon

      Re: No Mention of AVG!

      AVG, 2018-01-04: "Thank you so much for bringing this to our attention."

      https://support.avg.com/answers?id=9060N000000TrZgQAK

    2. Anonymous South African Coward Silver badge

      Re: No Mention of AVG!

      I also have two P2's - one @ 266MHz and the other at 350MHz.

      Only need a case, got everything for a fine and purdy compootah.

    3. Anonymous Coward
      Anonymous Coward

      Re: No Mention of AVG!

      It's coming to that. One computer for browsing with everything else disconnected from it. That'll make it tough to run a mail server effectively, but what with NICs and Bluetooth not having hard shutoff switches and ME/UEFI there's probably no real extra risk, I guess. To be honest, it feels like most, maybe all, Governments approach to proprietary OSs and software is an extended play in graft and corruption. It's probably a lack of knowledge on Politicians part, but it certainly plays into the deepening distrust people have of Government.

  14. Flocke Kroes Silver badge

    Has anyone checked if existing malware is compatible with the meltdown update?

    Presumably malware uses details of how Windows organises virtual memory and changes in this area may cause malware to crash the OS. Have malware authors provided updates so normal uses can enjoy the benefits of keyloggers and RATs without risk of BSODs?

    1. Korev Silver badge
      Coffee/keyboard

      Re: Has anyone checked if existing malware is compatible with the meltdown update?

      Love it! -->

  15. Anonymous Coward
    Boffin

    FUD

    This confirms to me that using 3rd party AV on 1709 build of Windows 10 creates more problems than solutions.

    1. hplasm Silver badge
      Gimp

      Re: FUD

      This confirms to me that using 1709 build of Windows 10 creates more problems than solutions.

      There you go.

      1. Anonymous Coward
        Anonymous Coward

        Re: FUD

        This confirms to me that using Windows creates problems.

        Even better.

  16. Joe Montana

    Disabled by default?

    If this update is disabled by default, how many people will install it and assume they're good to go without even realising that it needs to be enabled?

  17. Mike_JC

    I have just checked Regedit and that DWORD above has been set already on my superb but not new Intel Core i3 desktop workstation.

    1. xenny

      It's set automatically if your AV including Defender is compatible

  18. Anonymous Coward
    Anonymous Coward

    Intel to provide Chips for Tesla?

    Ok, ok, so what happens when my Tesla Model Z articulated truck suffers a "meltdown" attack while I'm touring the Norwegian Atlantic Coast Road while "Kindling" a book from Amazon on my Samsung Galaxy Note 7?

    Sounds like ARMageddon.

    1. stewski

      Re: Intel to provide Chips for Tesla?

      Or even cARMageddon if you follow the kick starter campaign...

  19. Scroticus Canis
    Trollface

    I'm felling like a smug git right now.

    "Apple has quietly patched the Meltdown bug in macOS 10.13.2 in December."

    Is schadenfreude bad karma?

    1. Spacedinvader
      Trollface

      Re: I'm felling like a smug git right now.

      Hopefully landing like one...

      1. Scroticus Canis
        Pint

        Re: Hopefully landing like one... - Your wish is granted!

        I just felt like a down vote Friday when I posted :) Didn't hear of any hassle with the macOS patch and had no AV problems with Sophos.

        However, karma has had its revenge as I find my beer has evaporated whilst I wasn't paying attention and I now have to get up and get another one. I will however dedicate it to all who won't make it to the pub at lunchtime due to this M$ SNAFU.

  20. Anonymous Coward
    Anonymous Coward

    SYMANTEC SEP

    Symantec have updated SEP and once rolled out the Registry Key is set so the system is offering the MS Patch - however the fix is flawed with users reporting issues - https://support.symantec.com/en_US/article.TECH248552.html

    We are now at the point where the MS patch is installed, the Symantec Update is installed on the PC but SEP is reporting multiple issues.

  21. jason 7 Silver badge

    Done...

    ...the patches and done all the benchmarks.

    No change.

    1. Roland6 Silver badge

      Re: Done...

      >...the patches and done all the benchmarks.

      No change.

      Are you sure the patches have actually been installed and enabled and not left in the "off by default" setting?

  22. MrBoring

    Not just AV

    It's not only AV that it breaks. Applying this update will break other applications.

    We've had reports already, Numecent’s CloudPaging solution https://www.numecent.com/cloudpaging/ stops working.

    With such a fundamental change to how Windows works, there will no doubt be many applications that fail and will need updating. This is why this patch needs the reg edit before it installs, as MS know this could potentially break loads of stuff.

    1. Bob Camp

      Re: Not just AV

      Which is why nobody should be forcing the update. Just let it happen naturally. Some systems may be vulnerable for several more days, but whats that compared to 22 years?

      1. stewski

        Re: Not just AV

        Happen naturally?

        "We're planning on having a home patching, we've even bought a patching pool, breathe, breathe"

  23. Anonymous South African Coward Silver badge

    We need a Mustrum Ridcully. Or somebody like Vetinari.

  24. LeahroyNake Silver badge

    Sophos

    I have checked with Sophos and they are rolling out updates today / Jan 5th that set the registry key so that the MS patch should be downloaded and applied etc.

    Fingers crossed it works.

    1. psychonaut

      Re: Sophos

      good luck sir, i hope all is well. i hope all is well with trend too....for my sake...

  25. MrReal

    And another way to take out a Win8 and 10 PC...

    Hopefully Microsoft will get around to fixing their giant File Explorer bug too one day.

    1. Get FLAC file and mess with a meta-data length field with a binary file editor.

    2. Put it on a Windows machine.

    3. View it in File Explorer. Note how each broken FLAC you view adds nearly 400MB to File explorers memory footprint. Copy it in File Explorer to watch it each another 400MB per copy made.

    4. As the machine runs out of memory and crashes, make a note to delete them from the command shell as File Explorer can't even look at them.

    I have no idea how File Explorer got this far in the world with this type of schoolboy error.

    1. MrReal

      Re: And another way to take out a Win8 and 10 PC...

      People are thumbing this down, I agree, it's a terrible bug.

      Lets hope they fix it too, bugs that can take down a PC just by looking at files are serious.

  26. John Brown (no body) Silver badge

    Free BSD popped up a message yesterday.

    "4 January: About the Meltdown and Spectre attacks: FreeBSD was made aware of the problems in late December 2017. We're working with CPU vendors and the published papers on these attacks to mitigate them on FreeBSD. Due to the fundamental nature of the attacks, no estimate is yet available for the publication date of patches."

    Looks like they'll be late to the party with any fixes since they weren't deemed important enough to be told about it months ago like the big boys.

    1. Anonymous Coward
      Anonymous Coward

      Re: Free BSD popped up a message yesterday.

      I suppose that don't pay enough Intel/AMD/Arm tax to be considered important.

  27. Anonymous Coward
    Anonymous Coward

    What a laugh...

    Microsucks has released the most insecure O/S, aka Spyware, aka Malware code on the planet under the guise of "Win 10" so I'd really count on them to mitigate execution of rogue code on Intel CPUs as much as I trust them to NOT release defective code and Spyware.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2020