Emergency Windows Update Removes Intel’s Buggy Spectre Patch

Emergency Windows Update Removes Intel’s Buggy Spectre Patch

The fallout from the Spectre and Meltdown CPU vulnerabilities continue to send ripples through the technology industry, and Intel is suffering more than most. Its chips were vulnerable to all three variants of these attacks, and its fixes have been heavily criticized for introducing new bugs and doing a poor job of protecting users. Now, Microsoft has issued a rare out-of-cycle patch for Windows systems that removes Intel’s Spectre patch. That has to be embarrassing for Intel.

When we talk about the attack “variants” we’re referring to specific vulnerabilities. Variant 3 is Meltdown, and Variant 1 and Variant 2 are Spectre. Of these three, Variant 2 (CVE-2017-5715) is proving to be quite difficult to pin down for Intel. This Spectre variant is what’s known as a branch target injection, which could allow an attacker to execute arbitrary code on a system. Needless to say, that’s a very bad thing.

When Spectre was originally discovered, researchers feared the only way to mitigate it would be to disable CPU’s “speculative execution” features, which allow CPUs to work ahead and do calculations that may be needed in the future. This would come with a big performance hit. Google managed to work out an alternative called “Retpoline,” but Intel went its own way.

According to Microsoft, the Intel patch for Spectre Variant 2 has been causing unexpected system glitches, corrupted data, and unexpected reboots. It’s shocking Intel’s patch could be this bad considering it was given advance notice of the defects months ago and had plenty of time to develop the fix. Intel also ran into problems with the Linux patches, which Linus Torvalds called “complete and utter garbage” last week. It even made the patches optional on Linux systems in apparent acknowledgment of how shabby they were.

Emergency Windows Update Removes Intel’s Buggy Spectre Patch

So, where does this leave Intel and users of Intel-based Windows systems? Technically, users are not protected from Spectre Variant 2 right now. The good news is there are no attacks using Spectre in the wild right now. With that in mind, Intel decided that the buggy patch was a greater threat to users than being hit with nonexistent Spectre malware.

If you already took the Spectre update, the new version should be rolling out to your system soon. It’s also available for manual installation from Microsoft’s website. Intel will have to work out a new patch for Spectre. It’s already told hardware vendors to stop distributing the code it put out previously.

Continue reading

Samsung Starts Rolling Out Galaxy S20 Android 11 Update on Verizon
Samsung Starts Rolling Out Galaxy S20 Android 11 Update on Verizon

Not only does this include the Googley Android 11 enhancements, but it also has numerous Samsung-specific changes as part of the One UI 3.0 revamp.

Time to Update: Google Patches 2 Severe Zero-Day Chrome Vulnerabilities
Time to Update: Google Patches 2 Severe Zero-Day Chrome Vulnerabilities

Unlike the last few zero-days, Google didn't find these security holes itself. Instead, it was tipped by anonymous third-parties, and the problems are severe enough that it hasn't released full details. Suffice it to say, you should stop putting off that update.

Apple Urges Immediate iPhone Update to Block Active Online Hacks
Apple Urges Immediate iPhone Update to Block Active Online Hacks

There's a new version of Apple's iOS software for iPhone and iPad devices, and as usual, Apple is going to start pestering users to update. This time, the nagging for iOS 14.4 comes with a little more urgency.

Samsung Promises to Update Its Android Phones Even Longer Than Google
Samsung Promises to Update Its Android Phones Even Longer Than Google

Smartphone updates have been a mess for as long as the modern smartphone has existed, but Samsung just took a big step in the right direction: The company has decided to extend security update support to a full four years.