Yet another surprise patch, KB 4078130, disables part of the Meltdown/Spectre patches

LASER_oneXM

Level 37
Thread author
Verified
Top Poster
Well-known
Feb 4, 2016
2,520
_________IMPORTANT NOTE:_____________
The patch is only available from the Update Catalog, and it’s the same patch for all versions of Windows.


Last night, Microsoft released KB 4078130 , which is specifically designed to turn off the Intel-identified buggy code in the Meltdown/Spectre patches. Sayeth Microsoft:

‘Intel has reported issues with recently released microcode meant to address Spectre variant 2 (CVE 2017-5715 Branch Target Injection) – specifically Intel noted that this microcode can cause “higher than expected reboots and other unpredictable system behavior” and then noted that situations like this may result in “data loss or corruption.” Our own experience is that system instability can in some circumstances cause data loss or corruption.

While Intel tests, updates and deploys new microcode, we are making available an out of band update today, KB4078130, that specifically disables only the mitigation against CVE-2017-5715 – “Branch target injection vulnerability.” In our testing this update has been found to prevent the behavior described.

The patch is only available from the Update Catalog, and it’s the same patch for all versions of Windows.


If you’ve avoided this month’s Meltdown/Spectre patches, there’s nothing you have to do. On the other hand, if you jumped into the trenches, this one might keep you from losing some data.

Microsoft goes on to say:

As of January 25, there are no known reports to indicate that this Spectre variant 2 (CVE 2017-5715 ) has been used to attack customers. We recommend Windows customers, when appropriate, reenable the mitigation against CVE-2017-5715 when Intel reports that this unpredictable system behavior has been resolved for your device.

It’s highly likely that when Intel gives the all-clear for Spectre variant 2, it’ll be part of yet another patch.

Moral of the story: Wait.
 
Last edited:
5

509322

This whole Spectre\Meltdown fiasco - what else does on call it ? - has been just another blunder by all parties involved. And the ones who pay along the way are those who are left trying to sort out what is what. Same familiar story isn't it ?

Average Joe doesn't even pay attention. And if he\she does do you think they are inclined or willing to devote the time and effort required to figure out the mess created by Intel, AMD, Google, Microsoft and others ? Already different parties have said contradictory things and already some of those parties have reversed themselves - not once, but multiple times.

Like I said early on, when the hysteria was at a fever pitch, it is wise to wait-and-see because in the months to come a lot of what was said early on is likely to be revised or "re-clarified." But no... everybody was caught-up in the hysteria, all-consumed with patching their systems against exploits that had little chance of happening. And just look at what is being done now, Intel is undoing at least part of an earlier patch. And the revisions, re-clarifications, reversals, jockeying, re-positioning and whatever you want to call it will continue in the months to come.

But the joke of it is that it is an update only available through the Update Catalog - as if Average Joe is going to even know what the Update Catalog is.

It's just another pathetic state of affairs.

At least with Google you have an out... just use Chromebook, you're better off.
 
Last edited by a moderator:

Danielx64

Level 10
Verified
Well-known
Mar 24, 2017
481
Like I said early on, when the hysteria was at a fever pitch, it is wise to wait-and-see because in the months to come a lot of what was said early on is likely to be revised or "re-clarified." But no... everybody was caught-up in the hysteria, all-consumed with patching their systems against exploits that had little chance of happening. And just look at what is being done now, Intel is undoing at least part of an earlier patch. And the revisions, re-clarifications, reversals, jockeying, re-positioning and whatever you want to call it will continue in the months to come.
To be fair, I updated my system at home to see what the real deal is and everything seems to be ok, but at work it a different story. I haven't applied any patches due to the fact that there were reported issues with SEP and the next big thing is that we are getting a new photocopier in the next few days.... so I want to avoid much of this crap if I can.
 
5

509322

To be fair, I updated my system at home to see what the real deal is and everything seems to be ok, but at work it a different story. I haven't applied any patches due to the fact that there were reported issues with SEP and the next big thing is that we are getting a new photocopier in the next few days.... so I want to avoid much of this crap if I can.

There is so much contradictory information out there that Average Joe cannot make sense of it. Even for people that have half a clue, it is a real pain.

Then you have forced Windows Updates on Windows 10 Home - right ?

It's just awesome... and I mean that in the most acrimonious and mocking way possible. That's my own personal perspective. Seems like Microsoft has just never learned its lessons from user complaints from decades past. If it cannot learn after decades, then it never will.
 
Last edited by a moderator:

shmu26

Level 85
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Jul 3, 2015
8,153
So what's with Google? They said that the next Chrome update would have a fix for the kernel exploits, but when Chrome finally updated, I didn't see any specific mention of such a fix.
 
5

509322

So what's with Google? They said that the next Chrome update would have a fix for the kernel exploits, but when Chrome finally updated, I didn't see any specific mention of such a fix.

What did you expect ?
 

shmu26

Level 85
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Jul 3, 2015
8,153
What did you expect ?
Either an acknowledgement that the fix was indeed issued, or a statement about the estimated time frame for the fix to be released.
The fix has actually been around for quite a long time as an optional Chrome flag, but I think they wanted to try and cut down the amount of RAM that it uses, so they could enable it by default.
 

shmu26

Level 85
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Jul 3, 2015
8,153
That's teorethical. How is it practical? :)
I meant to say that recent kernel exploits apply to Linux, too, because they stem from the CPU, and Linux also uses Intel and AMD, just like Windows does.
They are not Windows-specific vulnerabilities, they are cross-platform.
 

brambedkar59

Level 29
Verified
Top Poster
Well-known
Apr 16, 2017
1,876
Okay, this is just ridiculous. Should I install this update or not? If YES then why the hell it's not shown in Windows update and if NO then why are they providing it on the update catalog.
 
  • Like
Reactions: Weebarra

codswollip

Level 23
Content Creator
Well-known
Jan 29, 2017
1,201
So what's with Google? They said that the next Chrome update would have a fix for the kernel exploits, but when Chrome finally updated, I didn't see any specific mention of such a fix.

Chrome 64.0.3282.119
This release contains additional mitigations against speculative side-channel attack techniques.
Chrome Releases: Stable Channel Update for Desktop

Okay, this is just ridiculous. Should I install this update or not?
Windows surprise patch KB 4078130: The hard way to disable Spectre 2
 

shmu26

Level 85
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Jul 3, 2015
8,153
Okay, this is just ridiculous. Should I install this update or not? If YES then why the hell it's not shown in Windows update and if NO then why are they providing it on the update catalog.
If you didn't receive or manually install a previous patch that is presently giving you grief, then you don't need this new patch. But it is there for those who need it, for those who are suffering from a previous patch.

I assume that they don't push it out to everyone because:
1 first they need to see if this new patch messes anything up
2 the whole situation is pretty fluid, so there might be a bigger and better patch on the way, making this one superfluous.
 

LASER_oneXM

Level 37
Thread author
Verified
Top Poster
Well-known
Feb 4, 2016
2,520
Okay, this is just ridiculous. Should I install this update or not? If YES then why the hell it's not shown in Windows update and if NO then why are they providing it on the update catalog.


source: Microsoft Security Update Release ~ Security Garden
Monday, January 29, 2018

Microsoft Security Update Release

Microsoft has issued an out-of-band Windows update that disables patches for the Spectre Variant 2 bug (CVE-2017-5715). The update is only needed if you installed the Intel BIOS/firmware update from the OEM and you are experiencing reboot issues.

The update applies to Windows 7 Service Pack 1, Windows 8.1, Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, Windows 10 Version 1703, Windows 10 version 1709, Windows Server 2008 R2, Standard Windows Server 2012 R2 Standard.

For those who need it, KB4078130 is only available from the Microsoft Update Catalog.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top