Hello, my name is Steve Mathias, Microsoft Premier Field Engineer (PFE) and I wanted to spend a moment to discuss the “mechanics” of the Intel Microcode Updates that you may see coming down from Microsoft Update or the Windows Catalog. The security implications of why you should update the microcode on your processors are already covered in the below documentation from us and our partners (Spectre/SBB/etc.):
https://support.microsoft.com/en-us/help/4093836/summary-of-intel-microcode-updates
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html
https://www.amd.com/en/corporate/product-security
The purpose of this blog is to help answer why Microsoft is collaborating with our partners Intel and AMD on these microcode updates and a little background on how these updates work. To start the discussion, we need to lay down a key fact:
- When processors are manufactured, they have a baseline microcode baked into their ROM. This microcode is immutable and cannot be changed after the processor is built.
Modern processors do have the ability at initialization to apply volatile updates to move the processor to a newer microcode level. However, as soon as the processor is rebooted, it reverts back to the microcode baked into their ROM. These volatile updates can be applied to the processor one of two ways – System Firmware/BIOS via OEM and by the Operating System (OS). However, as stated earlier, neither is updating the microcode in the processors ROM. If you were to remove the processor from one computer and install in a computer with an older System Firmware/BIOS and an un-updated OS, you will be back to being vulnerable.
Couple common questions:
- Why is Microsoft collaborating with Intel and AMD and publishing Microcode Updates via Microsoft Update?
The answer is simply that Windows offers the broadest coverage and quickest turnaround time to address these vulnerabilities. Microcode updates delivered via the Windows OS are not new; as far back as 2007 some updates were made available to address performance and reliability concerns.
- Can I skip taking updates delivered via Windows and only take updates from my OEM via System Firmware/BIOS Update?
Technically speaking you could but as mentioned earlier, often Microsoft Update may have the microcode updates to address issues much sooner. Work with your OEM to help make this decision or simply take the updates from Microsoft Update.
- Is there a problem if I update my System Firmware/BIOS with one version of a microcode update and allow Windows to install a different version of a microcode update?
When the processor boots, it has versioning to make sure it is utilizing the latest microcode updates regardless of where it may be coming from. So, installing System Firmware/BIOS updates and microcode updates from Microsoft Update is perfectly acceptable. It is possible that the OEM updates the microcode to one level and the OS updates the microcode to an even higher level during the same boot.
- In Windows, how are microcode updates delivered to the processor?
Microcode updates install like any other update. They can be installed from Microsoft Update, WSUS, SCCM or manually installed if downloaded from the Catalog. The key difference is that the payload of the hotfix is primarily one of two files:
mcupdate_GenuineIntel.dll – Intel
mcupdate_AuthenticAMD.dll - AMD
These files contain the updated microcode and Windows automatically loads these via OS Loader to patch the microcode on the boot strap processor. This payload is then passed to additional processors as they startup as well the Hyper-V hypervisor if enabled.
Hopefully this information will help demystify what these microcode updates are and allow you to confidently install these updates proactively.
