Protect your Windows devices against speculative execution side-channel attacks

On August 6, 2019, Intel disclosed details for security vulnerability CVE-2019-1125 | Windows Kernel Information Disclosure Vulnerability. Security updates for this vulnerability were released as part of the July monthly update release on July 9, 2019.

Microsoft released a security update for the Windows operating system on July 9, 2019 to help mitigate this issue. We held back documenting this mitigation publicly until the coordinated industry disclosure on Tuesday, August 6, 2019.

Customers who have Windows Update enabled and have applied the security updates released on July 9, 2019 are protected automatically. Note that this vulnerability does not require a microcode update from your device manufacturer (OEM).

On May 14, 2019, Intel published information about a new subclass of speculative execution side-channel vulnerabilities known as Microarchitectural Data Sampling and were assigned the following CVEs:

• CVE-2018-11091 – “Microarchitectural Data Sampling Uncacheable Memory (MDSUM)”
• CVE-2018-12126 – “Microarchitectural Store Buffer Data Sampling (MSBDS)”
• CVE-2018-12127 – “Microarchitectural Fill Buffer Data Sampling (MFBDS)”
• CVE-2018-12130 – “Microarchitectural Load Port Data Sampling (MLPDS)”

For more information about this issue, see the following Security Advisory and use scenario-based guidance outlined in the Windows guidance for Clients and Server articles to determine actions necessary to mitigate the threat:

• ADV 190013 | Microsoft Guidance to mitigate Microarchitectural Data Sampling vulnerabilities
• KB 4073119 | Windows IT Pro Client Guidance to protect against speculative execution side-channel vulnerabilities
• KB 4457951 | Windows Server Guidance to protect against speculative execution side-channel vulnerabilities

Microsoft has released protections against a new subclass of speculative execution side-channel vulnerabilities known as Microarchitectural Data Sampling for 64-Bit (x64) versions of Windows (CVE-2018-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130).

Use the registry settings as described in the Windows Client (KB4073119) and Windows Server (KB4457951) articles These registry settings are enabled by default for Windows Client OS editions and Windows Server OS editions.

We recommend that you install all of the latest updates from Windows Update first, before you install any microcode updates.

For more information about this issue and recommended actions, see the following Security Advisory: 

• ADV 190013 | Microsoft Guidance to mitigate Microarchitectural Data Sampling vulnerabilities

Intel has released a microcode update for recent CPU platforms to help mitigate CVE-2018-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130. The May 14, 2019 Windows KB 4093836 lists specific Knowledge Base articles by Windows OS version.  The article also contains links to the available Intel microcode updates by CPU. These updates are available via the Microsoft Catalog.

Note: We recommend that you install all of the latest updates from Windows Update before you install any microcode updates.

We’re happy to announce that the Retpoline is enabled by default on Windows 10, version 1809 devices (for client and server) if Spectre Variant 2 (CVE-2017-5715) is enabled. By enabling Retpoline on the latest version of Windows 10, via the May 14, 2019 update (KB 4494441), we anticipate enhanced performance, particularly on older processors.

Customers should ensure previous OS protections against the Spectre Variant 2 vulnerability are enabled using the registry settings described in the Windows Client and Windows Server articles. (These registry settings are enabled by default for Windows Client OS editions but disabled by default for Windows Server OS editions). For more information about “Retpoline”, see Mitigating Spectre variant 2 with Retpoline on Windows.

Microsoft has released operating system protections for Speculative Store Bypass (CVE-2018-3639) for AMD processors (CPUs).

Microsoft has released additional operating system protections for customers using 64-bit ARM processors. Please check with your device OEM manufacturer for firmware support because ARM64 operating system protections that mitigate CVE-2018-3639, Speculative Store Bypass, require the latest firmware update from your device OEM.

On September 11, 2018, Microsoft released Windows Server 2008 SP2 Monthly Rollup 4458010 and Security Only 4457984 for Windows Server 2008 that provide protections against a new speculative execution side-channel vulnerability known as L1 Terminal Fault (L1TF) affecting Intel® Core® processors and Intel® Xeon® processors (CVE-2018-3620 and CVE-2018-3646). 

This release completes the additional protections on all supported Windows system versions through Windows Update. For more information and a list of affected products, please see ADV180018 | Microsoft Guidance to mitigate L1TF variant.

Note: Windows Server 2008 SP2 now follows the standard Windows servicing rollup model. For more information about these changes, please see our blog Windows Server 2008 SP2 servicing changes. Customers running Windows Server 2008 should install either 4458010 or 4457984 in addition to Security Update 4341832, which was released on August 14, 2018. Customers should also ensure previous OS protections against Spectre Variant 2 and Meltdown vulnerabilities are enabled using the registry settings outlined in the Windows Client and Windows Server guidance KB articles. These registry settings are enabled by default for Windows Client OS editions but is disabled by default for Windows Server OS editions.

Microsoft has released additional operating system protections for customers using 64-bit ARM processors. Please check with your device OEM manufacturer for firmware support because ARM64 operating system protections that mitigate CVE-2017-5715 - Branch target injection (Spectre, Variant 2) require the latest firmware update from your device OEMs to take effect.

On August 14, 2018, L1 Terminal Fault (L1TF) was announced and assigned multiple CVEs. These new speculative execution side-channel vulnerabilities can be used to read the content of memory across a trusted boundary and, if exploited, can lead to information disclosure. There are multiple vectors by which an attacker could trigger the vulnerabilities depending on the configured environment. L1TF affects Intel® Core® processors and Intel® Xeon® processors.

For more information about L1TF and a detailed view of affected scenarios, including Microsoft’s approach to mitigating L1TF please see the following resources:

• ADV180018 | Microsoft Guidance to mitigate L1TF variant
• Security Advisory Security Research Blog
• Server Guidance for L1 Terminal Fault

On June 13, 2018, an additional vulnerability involving side-channel speculative execution, known as Lazy FP State Restore, was announced and assigned CVE-2018-3665. There are no configuration (registry) settings needed for Lazy Restore FP Restore.

For more information about this vulnerability, affected products, and recommended actions, see the following Security Advisory:

• ADV180016 | Microsoft Guidance for Lazy FP State Restore

Intel recently announced that they have completed their validations and started to release microcode for recent CPU platforms related to Spectre Variant 2 (CVE 2017-5715 “Branch Target Injection”). KB4093836 lists specific Knowledge Base articles by Windows version. The article contain links to the available Intel microcode updates by CPU.

On June 12, Microsoft announced Windows support for Speculative Store Bypass Disable (SSBD) in Intel processors. The updates require corresponding firmware (microcode) and registry updates for functionality. For information about the updates and the steps to apply to turn on SSBD, see the "Recommended actions" section in ADV180012 | Microsoft Guidance for Speculative Store Bypass.

In January 2018, Microsoft released information about a newly discovered class of hardware vulnerabilities (known as Spectre and Meltdown) that involve speculative execution side channels that affect AMD, ARM, and Intel CPUs to varying degrees. On May 21, 2018 Google Project Zero (GPZ), Microsoft, and Intel disclosed two new chip vulnerabilities that are related to the Spectre and Meltdown issues that are known as Speculative Store Bypass (SSB) and Rogue System Registry Read.

The customer risk from both disclosures is low.

For more information about these vulnerabilities, see the following resources:

• Microsoft Security Advisory for Speculative Store Bypass: MSRC ADV180012 and CVE-2018-3639
• Microsoft Security Advisory for Rogue System Register Read: MSRC ADV180013 and CVE-2018-3640
• Security Research and Defense: Analysis and mitigation of speculative store bypass (CVE-2018-3639)

Applies to: Windows 10, version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), and Windows Server, version 1709 (Server Core installation)

We have provided support to control usage of Indirect Branch Prediction Barrier (IBPB) within some AMD processors (CPUs) for mitigating CVE-2017-5715, Spectre Variant 2 when you switch from user context to kernel context. (For more information, see AMD Architecture Guidelines around Indirect Branch Control and AMD Security Updates).

Customers who are running Windows 10, version 1607,  Windows Server 2016, Windows Server 2016 (Server Core installation), and Windows Server, version 1709 (Server Core installation) must install security update 4103723 for additional mitigations for AMD processors for CVE-2017-5715, Branch Target Injection. This update is also available through Windows Update.

Follow the instructions that are outlined in KB 4073119 for Windows Client (IT Pro) guidance and KB 4072698 for Windows Server guidance to enable usage of IBPB within some AMD processors (CPUs) for mitigating Spectre Variant 2 when you switch from user context to kernel context.

Microsoft is making available Intel validated microcode updates around Spectre Variant 2 (CVE-2017-5715 “Branch Target Injection”). To get the latest Intel microcode updates through Windows Update, customers must have installed Intel microcode on devices running a Windows 10 operating system prior to upgrading to the Windows 10 April 2018 Update (version 1803).

The microcode update is also available directly from Catalog if it was not installed on the device prior to upgrading the OS. Intel microcode is available through Windows Update, WSUS, or the Microsoft Update Catalog. For more information and download instructions, see KB 4100347.

We will offer additional microcode updates from Intel for the Windows operating system as they become available to Microsoft.

Microsoft is making available Intel validated microcode updates around Spectre Variant 2 (CVE-2017-5715 "Branch Target Injection"). KB 4093836 lists specific Knowledge Base articles by Windows version. Each specific KB contains the latest available Intel microcode updates by CPU.

We will offer additional microcode updates from Intel for the Windows operating system as they become available to Microsoft.

You will have to check with your device manufacturer for firmware (microcode) updates. If your device manufacturer is not listed in the table, contact your OEM directly.