Community
cancel
Showing results for 
Search instead for 
Did you mean: 
THeit
Beginner
1,348 Views

Are Meltdown/Spectre completely resolved by the Intel BIOS updates? (no need for OS update if you update the BIOS)

Jump to solution

Consider a platform which uses a custom OS which has no mitigation for Spectre/Meltdown - or consider that it is not possible (or simply inconvenient) to apply OS updates to mitigate these issues ...

Will the BIOS updates from Intel completely resolve the current Spectre/Meltdown vulnerabilities on their own?

(or if you apply the BIOS fixes - do you also need OS updates anyway?)

And is there a statement from Intel making this clear?

Thanks for your help!

0 Kudos
1 Solution
n_scott_pearson
Super User Retired Employee
152 Views

No, absolutely not!

The microcode updates only contain the fix for SpectreB. SpectreA and Meltdown are currently being addressed by O/S workarounds. If it is "inconvenient" to apply the O/S updates, then the machines in question remain vulnerable. This is not something that you want, considering that sample code showing how to take advantage of these vulnerabilities has actually started appearing in places such as GitHub, so I suggest you overcome this "inconvenience".

Yes, there are statements from Intel regarding this. Here are the related links:

https://www.intel.com/content/www/us/en/architecture-and-technology/facts-about-side-channel-analysi... Facts about The New Security Research Findings and Intel Products

https://security-center.intel.com/advisory.aspx?intelid=intel-sa-00088&languageid=en-fr INTEL-SA-00088 Advisory

https://newsroom.intel.com/wp-content/uploads/sites/11/2018/03/microcode-update-guidance.pdf Latest Microcode Update Guidance (01-03-18)

https://newsroom.intel.com/wp-content/uploads/sites/11/2018/02/microcode-update-guidance.pdf Latest Microcode Update Guidance (20-02-18)

...S

View solution in original post

3 Replies
n_scott_pearson
Super User Retired Employee
153 Views

No, absolutely not!

The microcode updates only contain the fix for SpectreB. SpectreA and Meltdown are currently being addressed by O/S workarounds. If it is "inconvenient" to apply the O/S updates, then the machines in question remain vulnerable. This is not something that you want, considering that sample code showing how to take advantage of these vulnerabilities has actually started appearing in places such as GitHub, so I suggest you overcome this "inconvenience".

Yes, there are statements from Intel regarding this. Here are the related links:

https://www.intel.com/content/www/us/en/architecture-and-technology/facts-about-side-channel-analysi... Facts about The New Security Research Findings and Intel Products

https://security-center.intel.com/advisory.aspx?intelid=intel-sa-00088&languageid=en-fr INTEL-SA-00088 Advisory

https://newsroom.intel.com/wp-content/uploads/sites/11/2018/03/microcode-update-guidance.pdf Latest Microcode Update Guidance (01-03-18)

https://newsroom.intel.com/wp-content/uploads/sites/11/2018/02/microcode-update-guidance.pdf Latest Microcode Update Guidance (20-02-18)

...S

View solution in original post

THeit
Beginner
152 Views

Thanks Scott -

We were aware that the OS mitigations only address part of the issues and that the BIOS update was still required on some platforms to fully correct SpectreB.

We were uncertain if the converse was true - whether the Intel BIOS fixes addressed the other vulnerabilities on their own.

Sounds like the Intel firmware updates do not fix Meltdown or SpectreA!

Thanks -

Tim

n_scott_pearson
Super User Retired Employee
152 Views

No, the converse is NOT true. There is absolutely nothing that the BIOS can do to assist with the SpectreA and/or Meltdown vulnerabilities. All it can do is load the microcode update that provides the fix for the SpectreB vulnerability.

...S

Reply