Windows 10: Azure Stack Guidance against speculative execution vulnerabilities

Brink · Jan 4, 2018

Azure Stack guidance to protect against the speculative execution side-channel vulnerabilities

Summary

Microsoft is aware of a new publicly disclosed class of vulnerabilities referred to as “speculative execution side-channel attacks” that affect many modern processors and operating systems including Intel, AMD, and ARM.

Microsoft has not received any information to indicate that these vulnerabilities have been used to attack customers at this time. Microsoft continues working closely with industry partners, including chip makers, hardware OEMs, and app vendors, to protect customers. To get all available protections, hardware or firmware updates and software updates are required. This includes microcode from device OEMs and, in some cases, updates to antivirus software.

This advisory addresses the following vulnerabilities:

CVE-2017-5715 (branch target injection)

CVE-2017-5753 (bounds check bypass)

CVE-2017-5754 (rogue data cache load)

To learn more about this class of vulnerabilities, see ADV180002.

Overview

The following sections will help you identify, mitigate, and remedy Azure Stack environments that are affected by the vulnerabilities that are identified in Microsoft Security Advisory ADV180002.

To address these issues, Microsoft is working in partnership with the hardware industry to develop mitigations and guidance.

Recommended actions

Azure Stack customers should take the following actions to help protect the Azure Stack infrastructure against the vulnerabilities:

Apply Azure Stack 1712 update. See the Azure Stack 1712 update release notes for instructions about how to apply this update to your Azure Stack integrated system.

Install firmware updates from your Azure Stack OEM vendor after the Azure Stack 1712 update installation is completed. Refer to your OEM vendor website to download and apply the updates.

Some variations of these vulnerabilities apply also to the virtual machines (VMs) that are running in the tenant space. Customers should continue to apply security best practices for their VM images, and apply all available operating system updates to the VM images that are running on Azure Stack. Contact the vendor of your operating systems for updates and instructions, as necessary. For Windows VM customers, guidance has now been published and is available in this Security Update Guide.

FAQ

Q1. How can I tell whether my Azure Stack is affected by this class of vulnerabilities?
A1: All Azure Stack integrated systems are affected by the class of vulnerabilities that are described in the MSRC Security Advisory ADV180002.

Q2. Where can I find the Azure Stack update to fix this class of vulnerabilities?
A2: See Azure Stack 1712 update release notes for instructions about how to download and apply this update to your Azure Stack integrated system. For more information about updates for Microsoft Azure Stack, see Manage updates in Azure Stack overview.

Q3. Where can I find the firmware updates for my Azure Stack integrated system?
A3: Firmware updates are OEM-specific. Refer to your OEM vendor website to download and apply the updates.

Q4. My Azure Stack integrated system is not running the latest update (1711). What should I do?
A4: Azure Stack updates are sequential. You would have to apply all previous updates before you can apply the Azure Stack 1712 update. For more information, see Azure Stack 1711 Update.

Q5. I'm running an Azure Stack Development Kit (ASDK). Is that affected by this class of vulnerabilities?
A5: Yes, it is. We recommend that you deploy the latest version of the ASDK. For firmware update, see your OEM vendor website to download and apply the updates.
Click to expand...

Source: https://support.microsoft.com/en-us/...on-side-channe

:)

Darlene Hamilton · Jan 4, 2018

Windows 10 we cannot connect to the update service

Apparently the problem is solved. It seemed to be "cured" by a Windows Update since then. I tried to manually update, and got that to work once (finding the update site was almost an exercise in futility, but I finally managed.) At least I assume it was
a later update. I singed on and did not observe the problem any more. I DO say that I've had to "re-register" Spotlight several times since the first update problem appeared, but even that seems to have worked itself out.

So, yes; it looks good, now, but I have no idea what the cause was.
Click to expand...

PLEASE READ :

Microsoft Security Advisory:
MSRC ADV180002

Intel:
Security Advisory

ARM:
Security Advisory

AMD:
Security Advisory

NVIDIA:
Security Advisory

Microsoft Secure blog:
Understanding the Performance Impact of Spectre and Meltdown Mitigations on Windows Systems

Windows for Business blog:
Windows Analytics now helps assess Meltdown and Spectre protections

Consumer Guidance:
Protecting your device against chip-related security vulnerabilities

Antivirus Guidance:
Windows security updates released January 3, 2018, and antivirus software

Guidance for AMD Windows OS security update block:
KB4073707: Windows operating system security update block for some AMD based devices

Update to Disable Mitigation against Spectre, Variant 2:
KB4078130: Intel has identified reboot issues with microcode on some older processors

Surface Guidance:
Surface Guidance to protect against speculative execution side-channel vulnerabilities

IT Pro Guidance:
Windows Client Guidance for IT Pros to protect against speculative execution side-channel vulnerabilities

Edge Developer Blog:
Mitigating speculative execution side-channel attacks in Microsoft Edge and Internet Explorer

Server Guidance:
Windows Server guidance to protect against speculative execution side-channel vulnerabilities

Server Hyper-V Guidance

Virtual Machine Resource Controls

Hyper-V Host CPU Resource Management

Azure Blog:
Securing Azure customers from CPU vulnerability

Azure KB:
KB4073235: Microsoft Cloud Protections Against Speculative Execution Side-Channel Vulnerabilities

Azure Stack guidance:
KB4073418: Azure stack guidance to protect against the speculative execution side-channel vulnerabilities

SQL Server guidance:
KB4073225: SQL Server Guidance to protect against speculative execution side-channel vulnerabilities

SCCM guidance:
Additional guidance to mitigate speculative execution side-channel vulnerabilities

'Mike P · Jan 4, 2018

Regarding KB4078130

Note Users who
do not have the affected Intel microcode do not have to download this update.

We are also offering a new option – available for
advanced users on affected devices – to manually disable and enable the mitigation against Spectre Variant 2 (CVE 2017-5715) independently through registry setting changes. The instructions for the registry key settings
can be found in the following Knowledge Base articles:

KB4073119: IT Pro Guidance

KB4072698:
Server Guidance

Windows 10: Azure Stack Guidance against speculative execution vulnerabilities

Azure Stack Guidance against speculative execution vulnerabilities

Azure Stack Guidance against speculative execution vulnerabilities

Azure Stack Guidance against speculative execution vulnerabilities - Similar Threads - Azure Stack Guidance

KB4072698: Windows Server and Azure Stack HCI guidance to protect against silicon-based...

KB4072698: Windows Server and Azure Stack HCI guidance to protect against silicon-based...

Microsoft CVE-2017-5715: Guidance to mitigate speculative execution side-channel...

Windows client guidance for IT Pros to protect against speculative

Surface Guidance for speculative execution side-channel vulnerability

SQL Server Guidance against speculative execution vulnerabilities

Mitigating speculative execution side channel hardware vulnerabilities

Windows Server Guidance against speculative execution vulnerabilities

Windows Client Guidance against speculative execution vulnerabilities