Windows 10: Hyper-V HyperClear Vulnerability Update

Brink · May 14, 2019

Four new speculative execution side channel vulnerabilities were announced today and affect a wide array of Intel processors. The list of affected processors includes Intel Xeon, Intel Core, and Intel Atom models. These vulnerabilities are referred to as CVE-2018-12126 Microarchitectural Store Buffer Data Sampling (MSBDS), CVE-2018-12130 Microarchitectural Fill Buffer Data Sampling (MFBDS), CVE-2018-12127 Microarchitectural Load Port Data Sampling (MLPDS), and CVE-2018-11091 Microarchitectural Data Sampling Uncacheable Memory (MDSUM). These vulnerabilities are like other Intel CPU vulnerabilities disclosed recently in that they can be leveraged for attacks across isolation boundaries. This includes intra-OS attacks as well as inter-VM attacks.

In a previous blog post, the Hyper-V hypervisor engineering team described our high-performing and comprehensive side channel vulnerability mitigation architecture, HyperClear. We originally designed HyperClear as a defense against the L1 Terminal Fault (a.k.a. Foreshadow) Intel side channel vulnerability. Fortunately for us and for our customers, HyperClear has proven to be an excellent foundation for mitigating this new set of side channel vulnerabilities. In fact, HyperClear required a relatively small set of updates to provide strong inter-VM and intra-OS protections for our customers. These updates have been deployed to Azure and are available in Windows Server 2016 and later supported releases of Windows and Windows Server. Just as before, the HyperClear mitigation allows for safe use of hyper-threading in a multi-tenant virtual machine hosting environment.

We have already shared the technical details of HyperClear and the set of required changes to mitigate this new set of hardware vulnerabilities with industry partners. However, we know that many of our customers are also interested to know how we’ve extended the Hyper-V HyperClear architecture to provide protections against these vulnerabilities.

As we described in the original HyperClear blog post, HyperClear relies on 3 main components to ensure strong inter-VM isolation:

Core Scheduler

Virtual-Processor Address Space Isolation

Sensitive Data Scrubbing

As we extended HyperClear to mitigate these new vulnerabilities, the fundamental components of the architecture remained constant. However, there were two primary hypervisor changes required:

Support for a new Intel processor feature called MbClear. Intel has been working to add support for MbClear by updating the CPU microcode for affected Intel hardware. The Hyper-V hypervisor uses this new feature to clear microarchitectural buffers when switching between virtual processors that belong to different virtual machines. This ensures that when a new virtual processor begins to execute, there is no data remaining in any microarchitectural buffers that belongs to a previously running virtual processor. Additionally, this new processor feature may be exposed to guest operating systems to implement intra-OS mitigations.

Always-enabled sensitive data scrubbing. This ensures that the hypervisor never leaves sensitive data in hypervisor-owned memory when it returns to guest kernel-mode or guest user-mode. This prevents the hypervisor from being used as a gadget by guest user-mode. Without always-enabled sensitive data scrubbing, the concern would be that guest user-mode can deliberately trigger hypervisor entry and that the CPU may speculatively fill a microarchitectural buffer with secrets remaining in memory from a previous hypervisor entry triggered by guest kernel-mode or a different guest user-mode application. Always-enabled sensitive data scrubbing fully mitigates this concern. As a bonus, this change improves performance on many Intel processors because it enables the Hyper-V hypervisor to more efficiently mitigate other previously disclosed Intel side channel speculation vulnerabilities.

Overall, the Hyper-V HyperClear architecture has proven to be a readily extensible design providing strong isolation boundaries against a variety of speculative execution side channel attacks with negligible impact on performance.
Click to expand...

Source: https://techcommunity.microsoft.com/...te/ba-p/566499

:)

Jefferson Ore · May 14, 2019

Hyper V deativication

Hi Geoffrey,

Hyper-V lets you run an operating system or computer system as a virtual machine on Windows. Before proceeding in disabling
Hyper-V, please create a backup of your files for security purposes.

To disable Hyper-V, please follow the steps below:

On the Cortana search box, type Turn Windows Features on or off and press
Enter.

Look for the Hyper-V folder.

Uncheck the tick-box next to the main Hyper-V folder and click
OK.

Restart your PC.

Should you have further questions, please let us know.

Rex99ny · May 14, 2019

Where is the Hyper V Manager, How to I start it ?

I am trying to setup an XP virtual Machine on Windows 10 Pro.

I followed the steps in Neil Peterson article of 5/9/2016.

System Requirements - done - ok

Install Hyper-V - done - ok

Create a Virtual Switch - skip

Create a Virtual Machine

Create a Virtual Machine with Hyper-V Manager

These steps walk through how to manually create a virtual machine and deploy an operating system to this virtual machine.

In Hyper-V Manager, click Action > New >
Virtual Machine to bring up the New

Uhhhhhhhhh - this step obviously implies one knows

1) Where the Hyper-V Manager is

2) How to start the Hyper-V Manager

Isn't that odd ?

Jordan Langford · May 14, 2019

Hyper-V

Hi Njha98,

You can remove Hyper-V by going to the control panel > add and remove programs > turn windows features on or off > and in the list there you should see Hyper-V

remove the checkbox and this will remove hyper-v

you may need to reboot

Windows 10: Hyper-V HyperClear Vulnerability Update

Hyper-V HyperClear Vulnerability Update

Hyper-V HyperClear Vulnerability Update

Hyper-V HyperClear Vulnerability Update

Hyper-V HyperClear Vulnerability Update - Similar Threads - Hyper HyperClear Vulnerability

hyper-v hyper-v xxx

hyper-v hyper-v xxx

Disabled Hyper-V but Hyper-V is still there

Hyper-V

Creators Update and Hyper-V - Upgrade Configuration Version

Clarification on Hyper-V

Hyper-V no sound

Audio in hyper-v

Hyper-V & Win10