Windows 10: Microsoft explains how Windows Server Hotpatching works

GHacks · Feb 22, 2022

Last year, Microsoft described its work on hotpatching Windows Updates to apply updates on the fly to Windows systems and remove the need to reboot the systems to install the updates. A new blog post on Microsoft's Tech Community website announces the introduction of Hotpatching support in Azure Automange for Windows Server. Microsoft released Windows Server 2022 recently.

Hotpatching offers several advantages over traditional means of installing updates on Windows machines. Microsoft highlights the three core benefits in the blog post:

Fewer reboots, which improves availability.

Faster deployment, as update packages "are smaller, install faster, and have easier patch orchestration".

Improved protection, as security updates may be installed immediately instead of scheduling a reboot.

Hotpatching works by "establishing a baseline with a Windows Update Latest Cumulative update" according to Microsoft. The company plans to release hotpatches periodically that build on that baseline, and these updates won't require a reboot. The baseline is refreshed with new cumulative updates then periodically as well.

Hotpatches could be released on every Patch Tuesday (once a month), and new baselines could be released every three months. In the best case, servers would need to be rebooted four times per year, when new baselines are applied.

Microsoft distinguishes between planned and unplanned baselines Planned baselines are released on a regular cadence to move the system to a new baseline. Hotpatches may then be installed in between these planned baseline releases.

Unplanned baselines are needed to patch systems if hotpatching cannot be used for a particular patch. Microsoft mentions fixes for 0-day vulnerabilities in particular. These unplanned baseline releases do require a reboot and include all content of the latest cumulative update.

Updates may be installed outside of the Hotpatch program according to Microsoft, but it requires disabling and unenrolling hotpatching to return to the default updating behavior for Windows Server. Reenrolling is possible at any time.

The rest of the announcement offers implementation details for server administrators.

Closing Words

Hotpatching improves the availability of Windows Server by reducing the number of update-related reboots over time. Additionally, security updates that are deployed via hotpatching are applied immediately instead of requiring a restart (immediately or on schedule); this reduces the time the machine is vulnerable to potential attacks targeting the vulnerability.

Microsoft is working on bringing the hotpatching functionality to a "wider set of Windows customers". It is unclear if this will include consumer versions of Windows.

Now You: what is your take on hotpatching? Would you use it? (via Deskmodder)

Thank you for being a Ghacks reader. The post Microsoft explains how Windows Server Hotpatching works appeared first on gHacks Technology News.

read more...

Brink · Feb 22, 2022

Microsoft details Hotpatching on Windows

Introduction

A core priority of the Windows Kernel team is to keep the operating system, applications, and users secure. Like many operating systems, Windows has a large codebase, a driver ecosystem, and a complex set of dependencies. Every day, many malicious actors attempt to find vulnerabilities. To fix these vulnerabilities, Microsoft has historically combined a group of security fixes into what is known as a security patch.

Updates on Windows

Traditionally, security patches have been deployed on the second Tuesday of every month, known as Patch Tuesday. These patches are developed by feature teams as a fix for various security vulnerabilities in the OS. By providing these security patches, we aim to make the Windows OS more secure and eliminate the opportunity of malicious actors to exploit vulnerabilities. Within each patch, both user mode (application) and kernel mode (system) binaries can be updated, and typically this requires a reboot.

Some scenarios require continuous or near-continuous availability. For example, the instances of Windows Server that power the Azure fleet are required to be highly available. However, we also require these operating system instances to be secure. While technologies like Kernel Soft Reboot and VM preserving host updates already exist to minimize VM downtime while changing major OS releases, security patches are applied frequently enough that even this technique impacts downtime.

Why do updates require rebooting?

Usually, many binaries from all over the system are accessed and changed when a patch is applied. The reason a reboot is almost always required is because a binary that must be updated is usually actively mapped in one or more processes so its code may be currently executing. Certain kernel and user-mode binaries, like win32k.sys or ntdll.dll, are always loaded into memory and some others, like Explorer.exe, are loaded when there is an active user session. When binaries such as these are patched as part of an update, a restart is required for the patch to be successfully installed. When an update targets the NT kernel or additional core components, a restart is always required because it is not possible to unload those binaries while their code is executing. Traditionally, even if one fix within the entire patch required a reboot, and all other patches didn’t require a reboot, the machine would still be required to reboot to successfully install the patch.

Current security issues with delayed patching

Security patches are intended to be applied to the Windows OS as soon as they are released from Microsoft. Often, users and system administrators will delay the installation of a patch because of the reboot that is frequently required upon completing the installation. This delay in patching, while seemingly convenient, is actually a security issue. The FireEye Mandiant Threat Intelligence report shows that in 2018 and 2019 the exploitation of 42% of vulnerabilities occurred after a patch was already released. Furthermore, internal MSRC data shows that in the year 2020, around 75% of public proof-of-concept vulnerability were exploited after a patch has been already released. By limiting or eliminating the time between when a patch is issued to when it is applied, there is a substantial opportunity to reduce the total number of exploited vulnerabilities.

What is Hotpatching?

Hotpatching is the capability of an Operating system to “on-the-fly” modify some code that may be currently executed by another entity (application or driver). The hotpatching process should be invisible to the application, library or driver that is executing the code. This implies that the hotpatch engine must respect some constraints, which will be explained later in this post. Hotpatching allows the OS to install security patches without requiring a reboot, ensuring a level of increased security without sacrificing the availability of the machine. By utilizing techniques in the Windows Kernel, updates can be applied without a direct impact to the user. In Server scenarios, hotpatching allows administrators to update their guest VMs without the need of rebooting the VMs, leading to reduced downtime. Hotpatching is one of the first techniques geared to bringing users a reboot-less security update future.

While hotpatch is a new feature for our customers, it has been in use in Azure Host OS for a while. Internal Azure administrators have been providing rebootless security updates to Azure Host machines for long enough to collect data and improve hotpatching itself. Hotpaching is a battle-tested method of updating binaries on a system without the need to reboot.

The Hotpatch architecture

Hotpatch is implemented in various parts of the NT kernel, Secure Kernel and Ntdll module. Before peeking at the engine’s architecture, we should explain how the system is able to dynamically patch a binary.

Hotpatching works at the function level, which means that functions are individually patched and not individual files or components. Function level hotpatching works by redirecting all invocations of an un-patched function belonging to a base image to a patched function belonging to a hotpatch image. Many types of binaries can be patched using this technique, including usermode executables (EXEs and DLLs), system drivers, and even the Hypervisor and Secure Kernel binaries. Note that hotpatch images are considered cumulative, which means that each hotpatch image includes the changes from all other previous hotpatch images targeting the same base image. Multiple hotpatch images can be applied to the same base image and can be rolled back in a similar manner. The latest version of Hotpatch supports both x64 and ARM64 architectures, including 32-bit code running under WOW64.

Patch images, shown in Figure 1, are standard PE (Portable Executable) images, but they contain special information. In particular, the Hotpatch Table (indexed by the Image load configuration directory) contains all the information that describes the patch image, like the expected engine version, the size of the patch table, patch sequence number, and an array of compatible base image descriptors.

Figure 1. Hotpatch image format.

Each patch image is designed for a specific base image. The compatible base image is identified through a checksum and a time-date stamp. The patch engine will refuse to apply the patch if the base image does not have the same checksum and time-date stamp of any descriptors. In this case the patch will be added to an internal list and applied only when the correct base image is loaded later (this procedure is called “Deferred application”.)

The operations that are performed by the engine for applying a patch are described by an array of hotpatch descriptors. A hotpatch descriptor tells the engine what type of patch each record specifies (function patch, global symbol patch, indirect call, CFG call target and so on...). It is composed of a header and one or more hotpatch records. Each record specifies the patch’s parameters that depend on the type of the descriptor, like the source and target function’s RVA, and the original opcodes bytes.

The Hotpatch engine

The Hotpatch engine is implemented in various parts of the operating system, mostly in the NT and Secure kernel. The engine, as introduced in the previous paragraph, supports different kinds of images: Hypervisor, Secure Kernel and its modules, NT Kernel drivers and User-mode processes. The hotpatch engine requires the Secure Kernel to be running.

For applying a patch to an image, the NT kernel takes several steps that start in the MiLoadHotPatch internal function, which temporarily maps the patch image in the system address space and performs the initial analysis with the goal to search and verify the hotpatch information contained in the PE data structures (showed in Figure 1). After the checksum and timestamp of the target image for which the patch has been designed are located, the NT kernel determines whether the corresponding base image is loaded in the system (the base image can also be a secure image, like the Hypervisor or the Secure Kernel, so this step also needs to invoke the secure kernel).

When a compatible image is detected, the NT kernel begins to apply the patch to the target base image using a procedure that is a bit different depending on the type of the base image (user-mode library or process, kernel driver or a secure image). In general, the hotpatch engine maps the patch image in the same address space as the base image (as showed in Figure 2): for user-mode patches, the patch image will be mapped in each process that has the base image loaded.

Note that the hotpatch engine also supports session drivers. A session driver is a driver that lives in a kernel-mode address space that is tied to the user logon session (note that the session address space is generated by one particular root page table entry, which is switched on demand by the Memory manager depending on the active session). This means that a particular session can have a driver mapped which does not exist in another session. The Hotpatch engine is able to attach to all sessions in the system thanks to the “HotPatch” process created in phase 1 of the NT Kernel initialization. This minimal process has the characteristic to not belong to any session. The hotpatch engine can thus use that process to temporarily attach to any session in the system and perform the patch application only to the sessions where the driver is currently loaded.

Figure 2. Various address spaces supported by hotpatching on Windows.

Once the hotpatch image is mapped, the patch engine within the kernel starts to apply the patch by performing Backward patch application as described by the hotpatch records:

Patches all callees of patched functions in the patch image to jump to the corresponding functions in the base image. The reason for this is to ensure that all the unpatched code executes from the original base image. For example, if function A calls function B in the original base image and the patch image patches function A but not function B, then the patch engine will update function B in the patch image to jump to function B in the original base image.

Patches the necessary references to global variables in hotpatch functions to point to the corresponding global variables in the original base image.

Patches the necessary import address table (IAT) references in the hotpatch image by copying the corresponding IAT entries from the original base image.

It then performs the Forward patch application by patching the necessary functions in the original base image to jump to the corresponding functions in the patch image. Once this is done for any given function in the original base image, all new invocations of that function will execute the new patched function code from the hotpatch image. Once the hotpatched function returns, it will return to the caller of the original function.

The described procedure, which, for kernel drivers, is executed by the Secure Kernel, has been highly simplified. Note that the hotpatching process requires proper synchronization: no processor should be able to execute original instructions while undergoing a patch application. Note that the Secure Kernel is able also to interact with Hyperguard. This allows protected Patchguard images to be correctly patched.

The Hotpatch Address Table (HPAT)

When applying a patch to a function, the Hotpatch engine should be able to store the trampoline needed for transferring the code execution from the base to the patched function. The trampoline can’t be stored in the old un-patched function for various reasons: currently running code may hit invalid instructions and there is also no guarantee that enough space exists in the old function’s code. Furthermore, the patch engine supports both the application and the revert (undo) of a patch, which means that the original replaced bytes would have to be stored somewhere. Trampoline code to transfer execution to the target function is placed in the Hotpatch Address table code page (abbreviated as HPAT).

When the system initially boots, the Windows loader determines the size of the HPAT area, which is composed of a combination of data and code pages (to support ARM64 and scenarios where Retpoline is enabled on x64). When HotPatch is enabled, each boot driver is loaded in memory by reserving the HPAT pages at the end of PE image (before the Retpoline code page. Further information about Retpoline on Windows are available here: Mitigating Spectre variant 2 with Retpoline on Windows - Microsoft Tech Community). Note that the term “reserved” means that no actual physical memory is consumed. This is handled similarly for user-mode binaries.

When a patch is applied to a base image, the HPAT pages for both the base and the patch images are mapped to valid physical pages. When a function is patched for the first time, the patch engine allocates an HPAT entry for it and fills the code and data slot with the trampoline code and the target address. Subsequent patches for a function only update the target address. Only a single instruction is replaced in the prologue of the original function’s code. The overwritten opcode is saved in the Undo table to be replaced if the patch is reverted. Figure 3 summarizes this process:

Figure 3. Code flow for a hotpatched function.

Windows Server 2022 - New Hotpatch features

The upcoming Windows Server 2022 release includes the following improvements which make hotpatching applicable to a wider set of changes:

Patch images can now import new functions from other binaries.

Hotpatch engine now support ARM64 as well.

The patch engine now supports a patch callback, exported in the patch image through the “__PatchMainCallout__” function. The callback allows the patch image to perform initialization steps (like allocating memory, initializing new globals and so on....) after one or both the phases of the patch application (described previously) completed.

HotPatch is compatible with Retpoline. A new Retpoline dispatch function (internally called “__guard_retpoline_jump_hpat”) is invoked from the HPAT code entry and can safely transfer the code execution to the target patch function without being vulnerable to Spectre v2 side channel attacks.

Conclusion

Hotpatch is a powerful feature used by the Azure Fleet and Windows Server Azure Edition to eliminate downtime when applying security patches or even adding small features to the OS. Although some limitations in the functions being patched still exist (for example function signatures can never be changed), most of them has been addressed in the new version of the Engine.

How can you get access to the hotpatch feature?

Hotpatch-based security updates are available to customers running Windows Server 2019 and Windows Server 2022 Azure Edition images in the Azure cloud within the automanage framework. Documentation is provided on this page. We are working on bringing hotpatch-based security updates to a wider set of Windows customers.

Andrea Allievi & Hotpatch Team.
Click to expand...

Source: https://techcommunity.microsoft.com/...s/ba-p/2959541

malware · Feb 22, 2022

Microsoft Outlines Pricing, Packaging and Licensing for Windows Server 2008

At Microsoft TechEd IT Forum 2007, Bob Kelly, corporate vice president of Infrastructure Server Marketing at Microsoft Corp., updated an audience of more than 5,000 IT professionals on the development of Windows Server 2008 and a new virtualization offering. As Microsoft nears the final stages of Windows Server 2008 development and the Feb. 27, 2008, worldwide launch event, Kelly announced detailed packaging, pricing and licensing information for Windows Server 2008.

This includes Microsoft’s server virtualization technology, Hyper-V, previously code-named “Viridian.” Kelly also announced the stand-alone virtualization server named Microsoft Hyper-V Server. Finally, Kelly outlined a complementary program, called the Server Virtualization Validation Program that allows virtual machine vendors to validate their solutions with Windows Server operating systems.

“Windows Server 2008 redefines what a server operating system delivers to customers,” Kelly said. “With more than 1 million downloads and evaluation copies, we’ve built Windows Server 2008 based on a solid foundation of customer feedback, which is reflected in the product’s ease of management, security enhancements and overall reliability. The unprecedented range of customer choices and the virtualization enhancements will help customers tailor solutions built to fit virtually any business need.”

“As the Johannes Gutenberg-University Mainz’ IT department, it is a priority for us to keep students and staff connected. Accordingly, we are looking forward to Windows Server 2008 features, such as advances in Terminal Services and the Hyper-V technology, to help us do that while maximizing resources,” said Carsten Allendoerfer, director of the Computing Center System Group at the Johannes Gutenberg-University Mainz.

Windows Server 2008 Packaging, Pricing and Licensing
Windows Server 2008 is available in eight versions, three of which include Hyper-V:

Windows Server 2008 Standard. This version has built-in, enhanced Web and virtualization capabilities, powerful tools that give customers greater control over their servers and streamline configuration and management tasks, and enhanced security features that work to harden the operating system to help protect their data and network and provide a solid, highly-dependable foundation for businesses. With Windows Server 2008 Standard edition, customers get one virtual instance per license.

Windows Server 2008 Enterprise. Windows Server 2008 Enterprise has the same features as Windows Server 2008 Standard, but with Windows Server 2008 Enterprise edition, customers get four virtual instances per license.

Windows Server 2008 Datacenter. Windows Server 2008 Datacenter delivers an enterprise-class platform for deploying business-critical applications. It helps customers improve availability and security features, and reduce infrastructure costs, by consolidating applications with virtualization licensing rights. And with Windows Server 2008 Datacenter edition, customers receive unlimited virtual instances per license.

Two versions offered without Hyper-V are targeted at specific workloads:

Windows Web Server 2008. Designed to be used as a single-purpose Web server, Windows Web Server 2008 delivers a rock-solid foundation of Web infrastructure capabilities in the next-generation Windows Server 2008. Integrated with the newly re-architected Internet Information Services (IIS) 7.0, ASP.NET, and the Microsoft .NET Framework, Windows Web Server 2008 helps enable any organization rapidly deploy Web pages, Web sites, Web applications and Web services.

Windows Server 2008 for Itanium-based Systems. Windows Server 2008 for Itanium-based Systems is optimized for large databases, and line-of-business and custom applications, providing high availability and scalability up to 64 processors to meet the needs of the most demanding and mission-critical solutions. Support for Itanium-based systems will now be offered through the new Windows Server 2008 for Itanium-based Systems edition, targeted at customers using the Intel Itanium platform and designed for these specific workloads.

Microsoft will also offer a range of versions of Windows Server 2008 without Hyper-V:

Windows Server 2008 Standard without Hyper-V

Windows Server 2008 Enterprise without Hyper-V

Windows Server 2008 Datacenter without Hyper-V

All will be available in 32-bit or 64-bit versions, with the exception of Windows Server 2008 for Itanium-based Systems, which will only be available as a 64-bit version. Other changes include the availability of Windows Web Server 2008, a 64-bit edition of Web server. The Hyper-V feature will only be available with 64-bit editions of Windows Server 2008.

Pricing for all Windows Server 2008 products will be increasing by approximately 1 percent for all distribution channels. Estimated MSRP are listed by each version below:

Windows Server 2008 Standard: $999 (with five Client Access Licenses, or CALs)

Windows Server 2008 Enterprise: $3,999 (with 25 CALs)

Windows Server 2008 Datacenter: $2,999 (per processor)

Windows Server 2008 for Itanium-based Systems: $2,999 (per processor)

Windows Web Server 2008: $469

Windows Server 2008 Standard without Hyper-V: $971 (with five CALs)

Windows Server 2008 Enterprise without Hyper-V: $3,971 (with 25 CALs)

Windows Server 2008 Datacenter without Hyper-V: $2,971 (per processor)

Microsoft Hyper-V Server

Microsoft Hyper-V Server, a hypervisor-based server virtualization product, complements the Hyper-V technology within Windows Server 2008, allowing customers to consolidate workloads onto a single physical server. In addition, Microsoft Hyper-V Server will increase original equipment manufacturer (OEM) partners’ ability to offer customers simplified, reliable and cost-effective virtualization solutions that can easily plug in to their existing infrastructure. Partners including Dell Inc., Fujitsu Siemens Computers, Fujitsu Ltd., Hitachi Ltd., HP, IBM Corp., Lenovo, NEC Corp. and Unisys are already committed to working with Microsoft to offer solutions based on Microsoft Hyper-V Server once it is available. The estimated manufacturer’s suggested retail price (MSRP) for Microsoft Hyper-V Server is $28 (U.S.).

“Microsoft and Dell are continuing to work together to provide virtualization solutions and by offering Microsoft Hyper-V Server across a wide variety of Dell servers,” said Rick Becker, vice president of Software and Solutions at Dell. “Our joint customers can continue to leverage their expertise with Microsoft technologies to rapidly provision new services and better manage and simplify their IT environment.”

“The combination of Microsoft Hyper-V Server, industry-leading HP ProLiant and BladeSystem servers, and our comprehensive services portfolio provides customers with an adaptive infrastructure that is simple to operate, reliable and cost effective,” said Scott Farrand, vice president of Industry Standard Server Software at HP. “HP plans to support customers in the adoption of Microsoft Hyper-V Server by delivering solutions that help them realize the benefits of a virtualized environment.”

Server Virtualization Validation Program
In response to industry and customer demands for more comprehensive technical support of virtual machines, Kelly also announced the Server Virtualization Validation Program. Beginning in June 2008, vendors will be able to self-test and validate certain technical requirements of their server virtualization software running Windows Server 2008 and prior versions. The program will enable Microsoft to offer cooperative technical support to customers running Windows Server on validated, non-Windows server virtualization software.

“Microsoft has worked with industry partners to create a technical support model that will meet customers’ growing demands,” Kelly said. “As more customers deploy and virtualize Windows-based applications on Windows Server 2008 or other server virtualization software, this program will help ensure that customers receive a joint support experience for their physical and virtual infrastructure deployments.”

“Technical support of virtualized images is an industrywide challenge,” said Roger Levy, senior vice president and general manager of Open Platform Solutions for Novell. “Our relationship with Microsoft provides us with a jointly supported solution today. Novell and Microsoft continue to collaborate to optimize bidirectional virtualization between Windows and SUSE Linux Enterprise with Xen. Microsoft’s server virtualization validation program provides customers with additional peace of mind when they run Windows as a guest in a validated environment such as SUSE Linux Enterprise.”

Source: Microsoft

malware · Feb 22, 2022

Microsoft Prepares Update for Windows Home Server

Microsoft's Windows Home Server officially launched earlier this month, is already preparing to be updated. Microsoft says that the new update is "part of the ongoing process of continually enhancing the customer experience with Windows Home Server." The update includes a few feature additions for Windows Home Server. Currently, users who login to their server when away from their home network - through an external URL like https://yourname.homeserver.com - are greeted with a security warning. The November 27 update will now provide users with a trusted SSL certificate for their Windows Home Severs. The SSL certification was provided with the help of Windows Live Domains and GoDaddy. Other new features include a "Delete All" button to remove home computer backups. Microsoft has also taken steps to make the Shared Folders and Server Storage aspects of Windows Home Server more robust and user friendly.

Source: DailyTech

Windows 10: Microsoft explains how Windows Server Hotpatching works

Microsoft explains how Windows Server Hotpatching works

Microsoft explains how Windows Server Hotpatching works

Microsoft explains how Windows Server Hotpatching works

Microsoft explains how Windows Server Hotpatching works - Similar Threads - Microsoft explains Server

Google explains how Google Search ads work

Please explain to me how the local password works.

Microsoft explain how the new "Sleeping tabs" feature works in Edge.

can someone explain how EFS works ?

How Would Explain?

Microsoft explains in-place upgrades from Windows Server 2008 R2 to Windows Server 2019

Microsoft explains how Dynamic Updates work on Windows 10

Microsoft explains why Windows Update was not working for some users

Please explain microsoft accounts...