Spectre and Meltdown patches causing trouble as realistic attacks get closer

[LASER_oneXM]

Driver incompatibilities and microcode problems are both being reported

Applications, operating systems, and firmware all need to be updated to defeat Meltdown and protect against Spectre, two attacks that exploit features of high-performance processors to leak information and undermine system security. The computing industry has been scrambling to respond after news of the problem broke early a few days into the new year.

But that patching is proving problematic. The Meltdown protection is revealing bugs or otherwise undesirable behavior in various drivers, and Intel is currently recommending that people cease installing a microcode update it issued to help tackle the Spectre problem. This comes as researchers are digging into the papers describing the issues and getting closer to weaponizing the research to turn it into a practical attack. With the bad guys sure to be doing the same, real-world attacks using this research are sure to follow soon.

Intel issued a microcode update that provided extra features that operating systems could use to protect against Spectre. But after reports of crashes, the company is now warning not to install it on systems with Haswell and Broadwell processors. If your motherboard or system vendor has an updated firmware with the new microcode, don't install it, and if you're using software such as VMware ESXi to update your microcode, VMware says you should revert to an earlier version.


This is all a mess. Some companies, such as cloud service providers, have no real option but to install all the updates, including the microcode updates, because their vulnerability is so great; their business is running untrusted third-party code. For the rest of us, there is urgency, but that needs to be balanced against reliability.