Windows 10: Intel Security Issue Update: Progress Continues on Firmware Updates

Source: https://newsroom.intel.com/news/secu...mware-updates/

 

Thanks for staying on top of this, Brink. It's always interesting to watch how long things take to percolate through the OEMs and the motherboard makers. We may see another round of firmware update next month, I'm guessing. MS just came out with firmware updates on 2/6 to "undo" the first hurry-up round that came out earlier in January. I shared my recent fix experiences in a recent blog post: Timely Firmware Update Rescues Surface Pro 3 - Windows Enterprise Desktop. Thanks again,
--Ed--

:)

 

Unable to update the BIOS

What was the reason Dell sent you a BIOS update ?

Can you also give the model designation of your Dell computer so that we can look up if you have the latest BIOS ?

But my guess is, the link Dell sent you does not contain a BIOS update. It contains a FIRMWARE update coming from Intel.

Recently, there happened to be a Security Advisory bulletin regarding Intel® Active Management Technology,
Intel® Small Business Technology, and Intel® Standard Manageability.

Intel Security Advisory Bulletin

DELL Security Bulletin

HP also released a firmware update in May 2017.

Since this is not a BIOS update, the installation of this firmware may be different for Dell computers. It was definitely different for my HP notebook.

I prepared a DOS-bootable USB flash drive and copied contents of the firmware update files. I then booted to the USB flash drive and ran the DOS command to install the firmware update.

Hope the info is useful.

 

is this a scam?

Hi Jonathan,

Microsoft is aware that a security vulnerability was recently discovered, affecting several manufacturers and many devices and applications. We're already working with Intel in the interest of our customers. We understand that hardware and software updates
both need to be installed to be fully protected against these chip-related security flaws.

Intel released this
article on January 22, 2018 regarding their most recent firmware update. They mentioned that they're already working around the clock to address the issues of the initial firmware update that caused more problems for their users.

We've also posted an article about protecting your device against chip-related security vulnerabilities. You can find it

here. While waiting for Intel to release a working firmware update, make sure to keep Windows and your antivirus software up-to-date to minimize the security risks on your computer.

Don't hesitate to let us know if you have any further concerns.

----

If you think this was useful, you may "mark it as an answer" to help those who are facing the same problem.

 

Has Microsoft said anything about eventually pushing out the CPU microcode update through Windows Update?

 

Intel Newsroom:

https://newsroom.intel.com/news/secu...mware-updates/

*Wink), then you can revert back to the old one.

 

Intel have Issued a new CPU MicroCode Guidance PDF Sheet yesterday . Found on this page 1/2 way down or the PDF is Below too....

https://newsroom.intel.com/press-kit...ntel-products/

microcode-update-guidance_02_09_18.pdf

 

Hi,
I sure wouldn't want MS pushing out a bios update
Flashing bios is risky enough and personally I do not want an update attempting to flash my bios *Biggrin
The update system is bad enough as it is start bricking mother boards and that will kiss the baby as far as 10 goes.

 

More "bla bla bla" from Intel. Looking forward to these microcodes failing aswell... I'm definitely not holding my breath, nor will I BIOS-rush any of my computers until the consensus is out. Fool me once, fool me twice and all that... You can try and eat me too, I'm quite salty.

 

I don't believe that Microsoft will ever get to the point of pushing out BIOS/EUFI updates. Nor do they need to...

As far as I know...

Windows has the ability to warm patch microcode on boot using the mcupdate_GenuineIntel.dll and mcupdate_AuthenticAMD.dll drivers (located at C:\Windows\System32) on boot, for Intel and AMD cpu's respectively. On my system the current versions are:





These drivers are simple blocks of microcode and cpu identifying information - contain the latest microcode for the system cpu during boot. Windows loads the microcode from these drivers instead, overwriting the microcode that is included with the firmware, without being committed to flash. This takes place prior to the Windows initialization, so, seemingly there's no partial exposure issues.

The draw back of having the latest microcode in the driver is that, at the time of reboot the latest microcode is lost. While for most people, this is not an issue; however, should one re-install Windows (starting fresh), the microcode maybe vulnerable to Spectre and other exploits, if and when the the BIOS/EUFI has not been updated that includes microcode that not vulnerable. Once the reinstalled Windows updated to the latest patches, it may have the latest microcode in the driver and no longer vulnerable. Provided Intel gets their act together...

This is not a specific process that exists in Windows only, other operating systems, like Linux, MacOS, etc., act pretty much the same way on the x86 system with BIOS/UFI/EUFI firmware. One could make the argument that other operating system have been doing this longer than Windows...

Personally, I don't see the need for updating the BIOS/EUFI with the latest operating systems. If the motherboard manufacturers have the fixed microcode for Intel/AMD CPUs, so will Microsoft and they will push it out with the next update. Relax people...

 

It does , I am not sure how effective it is , not going to get into that, but it is fairly easy to check it , especially if you use the attached Batch File (below), I made a few weeks back after seeing another post on this....(and posted here on 10 somewhere) , the Pic is my current Bios and Window's MC , however it does not mean I pass the GRC Flaw test for example on my X99 based 5820k CPU , which I suspect Queries the CPU itself.

KB

 

On my i5-3350P system, the Windows MC is replacing the BIOS microcode:





The BIOS version in the Ivy Bridge system is F11 from 2012. The newer F12 version is available, but it is from 2013 and has no microcode update. AFAIK....

On the other hand, in the i5-8400 system the BIOS microcode is not replaced by Windows MC:





Both systems have the exact same mcupdate*.dll files, including the dates. The chances are that Microsoft rolled back the microcode update at the end of January, that had been released at the beginning of January, but will not override newer version of the microcode.

The BIOS version in the i5-8400 is 0606, dated as:





The 0607 version is available as of 02.02.18, but it does not include microcode updates.


The HWiNFO64 is nice, it does detect the BIOS (rather EUFI) version correctly, but the date is incorrect:

 

Thanks for MC.bat file...

 

Happy to see my old trusty Lenovo units, T520 and X220 Tablet, show up recently on the company's list of platforms for which microcode patches are planned. For those who also own Lenovo devices, here's the link to their list of planned patches, still forthcoming: Reading Privileged Memory with a Side Channel. Still no word from Asrock, though.
HTH,
--Ed--