Windows Update and security fixes.

Hi all,

Since several years, many securities issues has been discovered in CPU.

Microsoft has been able to update CPU microcode revision which is prerequisite to handle mitigation OS fixes on some CPU. That is a good point for overall security.

Unfortunately, that is not enough, and our computer are still vulnerable, because there are other actions that are not done by Windows Update.

After that, you have to update registry like this page:

https://support.microsoft.com/en-us/help/4073119/protect-against-speculative-execution-side-channel-vulnerabilities-in

Actually, no information about 1909 build, but Microsoft tell me that mitigations are still not installed on this new build. And consequently, there will be a lot of users and administrators that thought that they are secured with there computer, which is not the case.

For the future next Windows build, it would be very good that Windows Update install all securities fixes and mitigations by default, to secured all computers that is very important in our dangerous world, and only allow for specific user's needs that have computer that are not connected to the network, the ability to remove some specific Windows security fixes.

Hope that this very important security improvement will be soon applied by Windows Update by default.

Best regards

Xavier

HotCakeX
MVP
Jan 29, 2020
Hi,
I think because that article says:
"Applies to: Windows 10, version 1903, Windows 10, version 1809, Windows 10, version 1803, Windows 10, version 1709, Windows 10, version 1607, Windows 10, Windows RT 8.1, Windows 8.1, Windows 7 Service Pack 1"

and there is no mention of 1909 in that entire page, so it's safe to assume that it is already fixed in version 1909, otherwise Microsoft would have included it in the article as well.
- Xavier_2020
  Copper Contributor
  Jan 29, 2020
  HotCakeXI totally agree with your analyze. The issue is that in reality, according to Microsoft expert internal tests, it is not yet safe or fixed with 1909 version. You still need to manually modify registry.
  - dretzer
    Iron Contributor
    Jan 29, 2020
    I think you misunderstood the side-channel mitigations article.
    If you have all Updates installed on a current Windows 10 (1809, 1903, 1909), and your firmware has the correct cpu microcode, you don't have to edit the registry.
    The article you linked to describes methods to disable certain mitigations if you run into problems, or enable special cases.
    If we talk about Windows Server, then it is a different story. There you have to manually activate part of the mitigations. As many of these mitigations can cost a substantial ammount of performance in certain server environments, it would not be wise to enable them without an admin testing it first.
    
    To sum it up:
    
    For Windows 10 Clients with Intel CPU, ALL operatingsystem-mitigations, except system-wide speculative store bypass mitigation, are enabled by default. You do NOT need to touch the registry if you don't have a special case where SSBD is a problem. SSBD-mitigations are only needed if you run vulnerable software. All operating system binaries are not vulnerable to SSBD. Be aware that system-wide SSBD-mitigation will impact end-user performance!
    
    For Windows Server 2019 with Intel CPU, you have to set 2 registry keys (FeatureSettingsOverride = 0, FeatureSettingsOverrideMask = 3) to get the same protections as a Windows 10 Client. You can easily set these keys for your servers with group policy.
    
    You need firmware-updates for your hardware to mitigate some of the vulnerabilites! you cannot mitigate side-channel vulnerabilites with windows updates and/or registry keys alone!
    
    If you want to know the protection state of a system, open powershell and install the speculationcontrol module. With this module you can use "get-speculationcontrolsettings" to get a complete rundown of side-channel-protections and vulnerabilites. It will tell you if your hardware is vulnerable in the first place, if os-mitigations are enabled and if hardware-support for this mitigations is available.
    If it tells you to update your device firmware, you need to check with your oem, or you will be vulnerable anyway.
    Xavier_2020
RAJUMATHEMATICSMSC
Brass Contributor
Mar 20, 2020
Xavier_2020 . I have applied the same registrykeys to windows 1909, but stii some processors are vulnerable , eventhough microsoft cant fix those.
- HotCakeX
  MVP
  Mar 20, 2020
  Which processors and why Microsoft can't fix them? source?

Forum Discussion

Windows Update and security fixes.