감사합니다.
Spectre and Meltdown 본문
Protect your Windows devices against Spectre and Meltdown
This article discusses the impact of the recently disclosed processor vulnerabilities, named “Spectre” and “Meltdown,” for Windows customers and provides resources to help keep your devices protected at home, at work, and across your enterprise.
Summary
Microsoft is aware of new vulnerabilities in hardware processors named “Spectre” and “Meltdown”. These are a newly discovered class of vulnerabilities based on a common chip architecture that, when originally designed, was created to speed up computers. The technical name is “speculative execution side-channel vulnerabilities”. You can learn more about these vulnerabilities at Google Project Zero.
Who is affected?
Affected chips include those manufactured by Intel, AMD, and ARM, which means all devices running Windows operating systems are potentially vulnerable (e.g., desktops, laptops, cloud servers, and smartphones). Devices running other operating systems such as Android, Chrome, iOS, and MacOS are also affected. We advise customers running these operating systems to seek guidance from those vendors.
At the time of publication, we have not received any information to indicate that these vulnerabilities have been used to attack customers.
Protections we’ve provided to date
Starting in January 2018, Microsoft released updates for Windows operating systems, Internet Explorer and Edge browsers to help mitigate these vulnerabilities and help to protect customers. We also released updates to secure our cloud services. We continue working closely with industry partners, including chip makers, hardware OEMs, and app vendors to protect customers against this class of vulnerabilities.
We encourage you to always install the monthly updates to keep your devices up-to-date and secure.
We will update this documentation when new mitigations become available and recommend you check back here regularly.
What steps should I take to help protect my devices?
You will need to update both your hardware and your software to address this vulnerability. This includes applicable firmware updates from device manufacturers and, in some cases, updates to your antivirus software as well. We encourage you to keep your devices up-to-date by installing the monthly security updates.
To receive all available protections, follow these steps to get the latest updates for both software and hardware:
Note
Before your begin, make sure your antivirus (AV) software is up to date and compatible. Check your antivirus software manufacturer's website for their latest compatibility information.
- Keep your Windows device up to date by turning on automatic updates.
- Check that you’ve installed the latest Windows operating system security update from Microsoft. If automatic updates are turned on, the updates should be automatically delivered to you, but you should still confirm that they’re installed. For instructions, see Windows Update: FAQ
- Install available hardware (firmware) updates from your device manufacturer. All customers will need to check with their device manufacturer to download and install their device specific hardware update. See below for a list of device manufacturer websites.
Note
Customers should install the latest Windows operating system security updates from Microsoft to take advantage of available protections. Antivirus software updates should be installed first. Operating system and firmware updates should follow. We encourage you to keep your devices up-to-date by installing the monthly security updates.
Resources
Depending on your role, the following support articles will help you identify and mitigate client and server environments that are affected by the Spectre and Meltdown vulnerabilities.
Microsoft Security Advisory: MSRC ADV180002
Intel: Security Advisory
ARM: Security Advisory
AMD: Security Advisory
NVIDIA: Security Advisory
Microsoft Secure blog: Understanding the Performance Impact of Spectre and Meltdown Mitigations on Windows Systems
Windows for Business blog: Windows Analytics now helps assess Meltdown and Spectre protections
Consumer Guidance: Protecting your device against chip-related security vulnerabilities
Antivirus Guidance: Windows security updates released January 3, 2018, and antivirus software
Guidance for AMD Windows OS security update block: KB4073707: Windows operating system security update block for some AMD based devices
Update to Disable Mitigation against Spectre, Variant 2: KB4078130: Intel has identified reboot issues with microcode on some older processors
Surface Guidance: Surface Guidance to protect against speculative execution side-channel vulnerabilities
IT Pro Guidance: Windows Client Guidance for IT Pros to protect against speculative execution side-channel vulnerabilities
Edge Developer Blog: Mitigating speculative execution side-channel attacks in Microsoft Edge and Internet Explorer
Server Guidance: Windows Server guidance to protect against speculative execution side-channel vulnerabilities
Server Hyper-V Guidance
Azure Blog: Securing Azure customers from CPU vulnerability
Azure KB: KB4073235: Microsoft Cloud Protections Against Speculative Execution Side-Channel Vulnerabilities
Azure Stack guidance: KB4073418: Azure stack guidance to protect against the speculative execution side-channel vulnerabilities
SQL Server guidance: KB4073225: SQL Server Guidance to protect against speculative execution side-channel vulnerabilities
SCCM guidance: Additional guidance to mitigate speculative execution side-channel vulnerabilities
Additional resources
List of OEM /Server device manufacturers
Use the links below to check with your device manufacturer for firmware updates. You will need to install both operating system and hardware/firmware updates for all available protections.
OEM Device Manufacturers | Link to microcode availability |
|---|---|
| Acer | https://us.answers.acer.com/app/answers/detail/a_id/53104 |
| Asus | https://www.asus.com/News/YQ3Cr4OYKdZTwnQK |
Dell | |
| Epson | http://www.epsondirect.co.jp/support/information/2018/secure201801b.asp |
| Fujitsu | |
HP | |
Lenovo | |
LG | |
| NEC | http://jpn.nec.com/security-info/av18-001.html |
Panasonic | |
Samsung | |
Surface | Surface Guidance to protect against speculative execution side-channel vulnerabilities |
Toshiba | |
Vaio |
Server OEM Manufacturers | Link to microcode availability |
|---|---|
Dell | |
| Fujitsu | http://www.fujitsu.com/global/support/products/software/security/products-f/jvn-93823979e.html |
HPE | http://h22208.www2.hpe.com/eginfolib/securityalerts/SCAM/Side_Channel_Analysis_Method.html |
| Huawei | http://www.huawei.com/au/psirt/security-notices/huawei-sn-20180104-01-intel-en |
Lenovo |
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
February 2018 Updates
Windows operating system updates for 32-bit (x86) systems
The following security updates provide additional protections for devices running 32-bit (x86) Windows operating systems. Microsoft recommends customers install the update as soon as available. We continue to work to provide protections for other supported Windows versions but do not have a release schedule at this time. Please check back here for updates.
Note: Windows 10 monthly security updates are cumulative month over month and will be downloaded and installed automatically from Windows Update. If you have installed earlier updates, only the new portions will be downloaded and installed on your device. For more information, see the related knowledge base article for technical details and tthe FAQ below.
Product Update Released | Released | Release Date | Release Channel | KB |
|---|---|---|---|---|
| Windows 10 - Version 1709 / Windows Server 2016 (1709) / IoT Core - Quality Update | Released | January 31 | WU, Catalog | KB4058258 |
| Windows Server 2016 (1709) - Server container | Released | February 13 | Docker Hub | KB4074588 |
| Windows 10 - Version 1703 / IoT Core - Quality Update | Released | February 13 | WU, WSUS, Catalog | KB4074592 |
| Windows 10 - Version 1607 / Windows Server 2016 / IoT Core - Quality Update | Released | February 13 | WU, WSUS, Catalog | KB4074590 |
| Windows 10 HoloLens - OS and Firmware Updates | Released | February 13 | WU, Catalog | KB4074590 |
| Windows Server 2016 (1607) - Container Images | Released | February 13 | Docker Hub | KB4074590 |
| Windows 10 - Version 1511 / IoT Core - Quality Update | Released | February 13 | WU, WSUS, Catalog | KB4074591 |
| Windows 10 - Version RTM - Quality Update | Released | February 13 | WU, WSUS, Catalog | KB4074596 |
January 2018 Windows operating system updates
Starting in January 2018, Microsoft released security updates to provide mitigations for devices running the following x64-based Windows operating systems. Customers should install latest Windows operating system security updates to take advantage of available protections. We are working to provide protections for other supported Windows versions but do not have a release schedule at this time. Please check back here for updates. For more information, see the related knowledge base article for technical details and the FAQ below.
Product Update Released | Released | Release Date | Release Channel | KB |
|---|---|---|---|---|
Windows 10 - Version 1709 / Windows Server 2016 (1709) / IoT Core - Quality Update | Released | January 3 | WU, WSUS, Catalog, Azure Image Gallery | |
Windows Server 2016 (1709) - Server container | Released | January 5 | Docker Hub | |
Windows 10 - Version 1703 / IoT Core - Quality Update | Released | January 3 | WU, WSUS, Catalog | |
Windows 10 - Version 1607 / Windows Server 2016 / IoT Core- Quality Update | Released | January 3 | WU, WSUS, Catalog | |
Windows Server 2016 (1607) - Container Images | Released | January 4 | Docker Hub | |
Windows 10 - Version 1511 / IoT Core - Quality Update | Released | January 3 | WU, WSUS, Catalog | |
Windows 10 - Version RTM - Quality Update | Released | January 3 | WU, WSUS, Catalog | |
Windows 10 Mobile (OS Build 15254.192) - ARM | Released | January 5 | WU, Catalog | |
Windows 10 Mobile (OS Build 15063.850) | Released | January 5 | WU, Catalog | |
Windows 10 Mobile (OS Build 14393.2007) | Released | January 5 | WU, Catalog | |
Windows 10 HoloLens | Released | January 5 | WU, Catalog | |
Windows 8.1 / Windows Server 2012 R2 - Security Only Update | Released | January 3 | WSUS, Catalog | |
Windows Embedded 8.1 Industry Enterprise | Released | January 3 | WSUS, Catalog | |
Windows Embedded 8.1 Industry Pro | Released | January 3 | WSUS, Catalog | |
Windows Embedded 8.1 Pro | Released | January 3 | WSUS, Catalog | |
Windows 8.1 / Windows Server 2012 R2 Monthly Rollup | Released | January 8 | WU, WSUS, Catalog | |
Windows Embedded 8.1 Industry Enterprise | Released | January 8 | WU, WSUS, Catalog | |
Windows Embedded 8.1 Industry Pro | Released | January 8 | WU, WSUS, Catalog | |
Windows Embedded 8.1 Pro | Released | January 8 | WU, WSUS, Catalog | |
Windows Server 2012 Security Only | Coming |
| WSUS, Catalog |
|
Windows Server 2008 SP2 | Coming |
| WU, WSUS, Catalog |
|
Windows Server 2012 Monthly Rollup | Coming |
| WU, WSUS, Catalog |
|
Windows Embedded 8 Standard | Coming |
| WU, WSUS, Catalog |
|
| ||||
Windows 7 SP1 / Windows Server 2008 R2 SP1 - Security Only Update | Released | January 3 | WSUS, Catalog | |
Windows Embedded Standard 7 | Released | January 3 | WSUS, Catalog | |
Windows Embedded POSReady 7 | Released | January 3 | WSUS, Catalog | |
Windows Thin PC | Released | January 3 | WSUS, Catalog | |
Windows 7 SP1 / Windows Server 2008 R2 SP1 Monthly Rollup | Released | January 4 | WU, WSUS, Catalog | |
Windows Embedded Standard 7 | Released | January 4 | WU, WSUS, Catalog | |
Windows Embedded POSReady 7 | Released | January 4 | WU, WSUS, Catalog | |
Windows Thin PC | Released | January 4 | WU, WSUS, Catalog | |
| ||||
Internet Explorer 11-Cumulative Update for Windows 7 SP1 and Windows 8.1 | Released | January 3 | WU, WSUS, Catalog | |
You will need to check with your device manufacturer for firmware updates. If your device manufacturer is not listed in the table, contact your OEM directly.
Updates for Microsoft Surface devices are available to customers through Windows Update. For a list of available Surface device firmware updates, see KB 4073065.
If your device is not from Microsoft, apply firmware updates from the device manufacturer. Contact your device manufacturer for more information.
Addressing a hardware vulnerability with a software update presents significant challenges and mitigations for older operating systems and can require extensive architectural changes. We are continuing to work with affected chip manufacturers and investigating the best way to provide mitigations, which may be provided in a future update. Replacing older devices running these older operating systems should address the remaining risk along with updated antivirus software.
Note
Products currently out of both mainstream and extended support will not receive these OS updates. We recommend customers update to a supported OS version.
We will not be issuing updates for the following platforms:
Windows operating systems that are currently out of support or those entering end of service (EOS) in 2018
Windows XP-based systems including WES 2009, POSReady 2009
Although Windows XP-based systems are affected products, Microsoft is not issuing an update for them because the comprehensive architectural changes required would jeopardize system stability and cause application compatibility problems. We recommend that security-conscious customers upgrade to a newer supported operating system to keep pace with the changing security threat landscape and benefit from the more robust protections that newer operating systems provide.
Updates to Windows 10 for HoloLens are available to HoloLens customers through Windows Update.
After applying the February 2018 Windows Security Update HoloLens customers do not need to take any additional action to update their device firmware. These mitigations will also be included in all future releases of Windows 10 for HoloLens.
For your device to be fully protected, you should install the latest Windows operating system security updates for your device and applicable firmware updates from your device manufacturer. These updates should be available on your device manufacturer's website. Antivirus software updates should be installed first. Operating system and firmware updates can be installed in either order.
You will need to update both your hardware and your software to address this vulnerability. You will also need to install applicable firmware updates from your device manufacturer for more comprehensive protection. We encourage you to keep your devices up-to-date by installing the monthly security updates.
In each Windows 10 feature update, we build the latest security technology deep into the operating system, providing defense-in-depth features that prevent entire classes of malware from impacting your device. Feature update releases are targeted twice a year. In each monthly quality update, we add another layer of security, one that tracks emerging and changing trends in malware to make up-to-date systems safer in the face of changing and evolving threats.
Microsoft has been working closely with affected antivirus partners to ensure all customers receive the January Windows security updates as soon as possible. If customers are not being offered January security updates, Microsoft recommends customers contact their antivirus provider directly. Recommendations:
- Ensure your devices are up to date with the latest security updates from Microsoft and from your hardware manufacturer. For more info on keeping your device up to date, see Windows Update: FAQ.
- Continue to practice sensible caution when visiting websites of unknown origin and do not remain on sites you do not trust. Microsoft recommends all customers protect their devices by running a supported antivirus program. Customers can also take advantage of built-in antivirus protection: Windows Defender for Windows 10 devices, or Microsoft Security Essentials for Windows 7 devices. These solutions are compatible in cases where customers can’t install or run antivirus software.
To help avoid adversely affecting customer devices, the Windows security updates released in January or February, , have not been offered to all customers. For details, see the Microsoft Knowledge Base Article 4072699.
Intel has reported issues with recently released microcode meant to address Spectre variant 2 (CVE 2017-5715 Branch Target Injection) – specifically Intel noted that this microcode can cause “higher than expected reboots and other unpredictable system behavior” and then noted that situations like this may result in “data loss or corruption.” Our own experience is that system instability can in some circumstances cause data loss or corruption. On January 22, Intel recommended that customers stop deploying the current microcode version on impacted processors while they perform additional testing on the updated solution. We understand that Intel is continuing to investigate the potential impact of the current microcode version and encourage customers to review their guidance on an ongoing basis to inform their decisions.
While Intel tests, updates and deploys new microcode, we are making available an out of band update today, KB4078130, that specifically disables only the mitigation against CVE-2017-5715 – “Branch target injection vulnerability.” In our testing this update has been found to prevent the behavior described. For the full list of devices, see Intel’s microcode revision guidance. This update covers Windows 7 (SP1), Windows 8.1, and all versions of Windows 10, for client and server. If you are running an impacted device, this update can be applied by downloading it from the Microsoft Update Catalog website. Application of this payload specifically disables only the mitigation against CVE-2017-5715 – “Branch target injection vulnerability.”
As of January 25, there are no known reports to indicate that this Spectre variant 2 (CVE 2017-5715) has been used to attack customers. We recommend Windows customers, when appropriate, reenable the mitigation against CVE-2017-5715 when Intel reports that this unpredictable system behavior has been resolved for your device.
Yes. While Security Only updates are not normally cumulative, to ensure customers are protected, Microsoft is including the mitigations against these vulnerabilities in the February Security Only updates. These updates also include the updates for AMD-based devices.
No. Security update 4078130 was a specific fix to prevent unpredictable system behaviors, performance issues, and/or unexpected reboots after installation of microcode. Applying the February security updates on Windows client operating systems enables all three mitigations. On Windows server operating systems, you still need to enable the mitigations after proper testing is performed. See Microsoft Knowledge Base Article 4072698 for more information.