cancel
Showing results for 
Search instead for 
Did you mean: 

How-to: Patch Meltdown and Spectre

Khaosd
Level 7
First things first, this guide is assuming the following:

1) You are using the Asus Maximus Hero VIII
2) You are on Windows 10 x64

If you are not using the same mobo, the few links i provided below pointing to the ASUS website will allow you to select your actual mobo's model, which in turn will also let you select the OS you're on. I'll also provide information on the various MS updates below for the various OSes.

As a last resort, things shouldn't be too hard to source for considering how large a scale these two exploits are currently, so google.

Also, take note I update whenever I am aware of the news, hence some steps may be redundant (eg. perhaps BIOS 3703 already updated the ME firmware). However I will follow exactly how I did it from start to end to ensure that it should work for you, like how it did for me.

So here goes:

Miscs.

First I updated Chrome and Firefox. Yep they too have taken measures to defend against meltdown and spectre, I assume the rest of the browsers should have caught on as well by now, so do remember to check for updates.

1. ME firmware + Interface

**The following fixes 8 critical vulnerabilities found in a review right before Spectre and Meltdown was announced, as such, this technically does not address Spectre and Meltdown, but imho, is equally an important fix. (Read more here: http://www.eweek.com/security/intel-patches-management-engine-for-critical-vulnerabilities)

Asus released updates for the ME firmware + Interface, this can be found here: https://www.asus.com/sg/Motherboards/MAXIMUS-VIII-HERO/HelpDesk_Download/

Firmware: http://dlcdnet.asus.com/pub/ASUS/mb/LGA1151/Z170-A/MEUpdateTool_UI_20171103_TP.zip
Interface: http://dlcdnet.asus.com/pub/ASUS/mb/03CHIPSET/Consumer_11.7.0.1040.zip

If you are using a different Mobo, you can just click on 'FIND ANOTHER MODEL >' right below the mobo's name. Once found, go search under Drivers and Tools.

Note the above are not the latest however they should suffice. To verify whether you are protected: https://downloadcenter.intel.com/download/27150?v=t

Just download and run the DiscoveryTool.GUI

2. Windows Update

Windows released a critical update. This should be auto updated if you'd never changed any windows policy or settings. To be sure, you can search for it in your add remove programs to see whether the following has been installed:

**Please note back when this update was released it conflicted with a few Anti Virus programs, you can see where your AV is right now: https://docs.google.com/spreadsheets/d/184wcDt9I9TUNFFbsAVLpzAtckQxYiuirADzf3cL42FQ/edit#gid=0 , it should be Y Y to ensure maximum compatibility.

*** There has been some controversy on how MS is handling the issue with setting the registry keys, however i leave it up to you to do your own research and weigh the consequences.

Windows 10 — KB4056892 (issued 1/3/18)
Windows 8.1 and Server 2012 R2— KB4056898 (issued 1/3/18)
Windows 7 SP1 and Server 2008 R2 SP1 — KB4056897 (issued 1/3/18)


Source & Direct download link if update not found: https://blog.barkly.com/meltdown-spectre-patches-list-windows-update-help#OS-updates

Now if you use AI SUITE 3, installing this update will break all the old versions. You can download the newer version(Beta) that fixes this issue, here: https://rog.asus.com/forum/showthread.php?98800-AI-Suite-3-Beta-Version-3-00-10-user-test-report-thr...

Note: Those who use AI SUITE 3 and have a tendency to update and/or reinstall may be aware it can be a beach to remove it completely. I will provide another guide below on how to do a clean install of AI SUITE 3.

3. Bios

Lastly, Asus release Bios 3703 for the ASUS Maximus Hero VIII, which originally was uploaded wrongly (2018/1/12 was for the Alpha), now I just checked and it seems like the download has been corrected: https://www.asus.com/sg/Motherboards/MAXIMUS-VIII-HERO/HelpDesk_Download/ (it should be dated 2018/1/15)

Regardless, if you are using a different Mobo, you can just click on 'FIND ANOTHER MODEL >' right below the mobo's name. Once found, go search under Drivers and Tools.

FYI, Asus Advisory on the various mobos and bios available: https://www.asus.com/News/V5urzYAT6myCC1o2

Final Check (Windows 10 PowerShell method)

**Although Win7 has PS, the steps to launch it is not so obvious, so I will suggest using a few 'checker' software available out there.

Now once that's done, you should be ready. Next is to do a check on whether everything's green:

1) Right click Start > Windows Powershell (Admin)

2) Type: Install-Module SpeculationControl , if prompted, Y

3) Type: Set-ExecutionPolicy RemoteSigned, if prompted, Y

4) Type: Import-Module SpeculationControl

5) Type: Get-SpeculationControlSettings

After which a bunch of information will show, Not to worry, just make sure that there are no red lines, everything should be green. Once that's done:

6) Type: Set-ExecutionPolicy Restricted

You can close Powershell now.

Post-Notes

Some say the windows update and / or the bios causes a drop in performance (Intel claims an 8% drop for 6 Gen 6700k: https://newsroom.intel.com/editorials/intel-security-issue-update-initial-performance-data-results-c...), I personally don't really feel anything... As a matter of fact, after updating the bios and oc-ing my CPU, I was able to reach 100mhz more on my OC. but yeah, I guess your mileage may vary.

Lastly, everything regarding Spectre and Meltdown as of now is still developing, and my guide is just the first few stepping stones for you. I may or may not update this post in future, considering I'm seeing more and more guides that are more concise and detailed. As such should this guide be not updated, with your experience going through my guide and with a little bit of googlefu, the follow ups should be a piece of cake.

If you still need a hand tho: https://blog.barkly.com/meltdown-spectre-patches-list-windows-update-help

I recommend them since they don't bury you in technical jargons, and most of my research was assisted by reading their article.

Good luck!


Windows 10: How to clean uninstall AI SUITE 3 and install the Beta

**should work on windows 7 as well

***I've encountered issues with AVIRA a few years ago, I suggest disabling it or any antivirus when you are installing the new AI SUITE 3 in step 8, should you encounter any issues.

Ai Suite is useful (to me), but it can be a real sore in the butt to remove and get it to work properly after a reinstall or update, I've personally done alot of research, reformat, re-installation to get to, what I feel is the cleanest and trouble free steps to get AI SUITE working. I now offer it to those who are having issues, although with all its quirks, I won't be surprised if you say my methods don't work. If so, I'm sorry I can't help more:

1) Uninstall the old AI SUITE 3, Restart your computer

2) Ctrl + Shift + Esc > head over to Services tab, sort by Description and, assuming you only have AI SUITE 3 installed, stop EVERYTHING with the word 'ASUS' (2 to 4 services usually), if not, you will have to find out which services are related to AI SUITE 3. Restart your computer

*If you are using Windows 7, you may be getting ALOT of "ATK_CMD stopped working" popups once desktop shows, ignore. (Windows 10 will have this error but it can only be seen in Reliability Viewer)

3) Go to C program files and delete the ASUS folder (assuming you only have AI SUITE 3 installed)

4) Show hidden folders and go to C program data and delete the ASUS folder (assuming you only have AI SUITE 3 installed)

5) Run CCleaner

6) Restart your computer, smash Delete (or any key that goes to BIOS), reset everything to optimized default, save and exit. Power down.

7) open up your case and hit the clr_cmos button, if unsure, check manual.

😎 Restart Computer, hit F1 if prompted, Save and restart computer. download the new AI SUITE beta (Link above), Install USING SETUP.exe INSTALL OF ASUSSETUP.exe!

Now AI SUITE 3 should work without issues, hopefully.
612 Views
46 REPLIES 46

bcx01
Level 7
Yeah I checked it with Powershell. The screenshot of those two lline come from Powershell

Nate152
Moderator
I found a reply from a user from another site, he enabled the patch and has 3 things that are false and 2 of them are the same as yours.

His reply:

I managed to enable the patch, but had to mod BIOS firmware with the latest microcode from intel for my CPU, i7-4960X on X79 ASUS Rampage IV Black Edition Mobo, Windows 10 x64 1709 16299.192

Before that I tried the VMWare driver, which gave me "hardware support for branch target injection mitigation: True", but I believe the OS loads the microcode too late for mitigation to be enabled.

Note that I did not have to add the registry keys as listed below to my machine in order to enable the patch:

https://support.microsoft.com/en-us/help/4073119/protect-against-speculative-execution-side-channel-...

Quoting from that link: "Note By default, this update is enabled. No customer action is required to enable the fixes. We are providing the following registry information for completeness in the event that customers want to disable the security fixes related to CVE-2017-5715 and CVE-2017-5754 for Windows clients."

Powershell output now looks like:

PS C:\Windows\System32\WindowsPowerShell\v1.0> Get-SpeculationControlSettings

Speculation control settings for CVE-2017-5715 [branch target injection]



Hardware support for branch target injection mitigation is present: True

Windows OS support for branch target injection mitigation is present: True

Windows OS support for branch target injection mitigation is enabled: True



Speculation control settings for CVE-2017-5754 [rogue data cache load]



Hardware requires kernel VA shadowing: True

Windows OS support for kernel VA shadow is present: True

Windows OS support for kernel VA shadow is enabled: True

Windows OS support for PCID performance optimization is enabled: False [not required for security]





BTIHardwarePresent : True

BTIWindowsSupportPresent : True

BTIWindowsSupportEnabled : True

BTIDisabledBySystemPolicy : False

BTIDisabledByNoHardwareSupport : False

KVAShadowRequired : True

KVAShadowWindowsSupportPresent : True

KVAShadowWindowsSupportEnabled : True

KVAShadowPcidEnabled : False

Friday, January 12, 2018 6:11 PM


-You could try running the cpu checker I posted to see your cpu is safe.

claudej
Level 7
Thanks Guys,
I had to update my ME Firmware with your tool (while I've got the different Gene Board). I wasn't Good before and I was after, I guess it worked.
I still don't understand where that update comes from, though.

I've had some issues about that Powershell method, I don't recommend it 🙂 . Not sure if I was able to reset the Powershell Strategy back to its original state. Restricted, right ?

Both Intel SA00086 GUI and InSpectre tools report I'm Good. The Ashampoo SpectreMeltdownCheck tool doesn't find my Powershell as usual, yet.

Regards,

SlackROG
Level 10
DID EVERYONE READ THIS?

Stop Patching your box!


---> http://www.bbc.com/news/technology-42788169#

The MODS need to make a Sticky/Post ---> Intel Tells Users To Stop Patching...



Nate152 wrote:
I was just going to ask if you tried the powershell fix, is windows 10 fall creators update up to date ?

https://www.windowscentral.com/how-check-if-your-pc-still-vulnerable-meltdown-and-spectre-exploits

Have you run the cpu checker for Spectre and Meltdown ?

https://www.ashampoo.com/en/usd/pin/1304/security-software/spectre-meltdown-cpu-checker

70708



Ashampoo LOL oh my... 😉

Not sure if this Ashampoo app is worth anything...

I'd personally be telling people to get Gibson's app at GRC over Ashampoo any day, sorry Nate...

https://www.grc.com/inspectre.htm

SlackROG wrote:
DID EVERYONE READ THIS?

Stop Patching your box!


---> http://www.bbc.com/news/technology-42788169#

The MODS need to make a Sticky/Post ---> Intel Tells Users To Stop Patching...






Ashampoo LOL oh my... 😉

Not sure if this Ashampoo app is worth anything...

I'd personally be telling people to get Gibson's app at GRC over Ashampoo any day, sorry Nate...

https://www.grc.com/inspectre.htm


Ashampoo and Inspectre say my pc is protected.

71034
71035

Nate152 wrote:
Ashampoo and Inspectre say my pc is protected.


Well your eye balls are on fire, you sure that Meltdown didn't hit you? 😉

Very bad that ASUS are still offering BIOS updates for download which include the early January microcode release which is known to cause problems. These should have been removed as recommended by Intel. 😞

In good news, Microsoft are releasing the fixed production microcode updates through Windows Update. Currently only for Windows 10 and Skylake, other CPUs (but not other O/S) will be added.
https://support.microsoft.com/en-us/help/4090007

IT Troll wrote:
Very bad that ASUS are still offering BIOS updates for download which include the early January microcode release which is known to cause problems. These should have been removed as recommended by Intel. 😞

In good news, Microsoft are releasing the fixed production microcode updates through Windows Update. Currently only for Windows 10 and Skylake, other CPUs (but not other O/S) will be added.
https://support.microsoft.com/en-us/help/4090007


Hello

Thanks for the warning.
Any problems with operation, stability or performance?
Thank you very much

IT Troll wrote:
Very bad that ASUS are still offering BIOS updates for download which include the early January microcode release which is known to cause problems. These should have been removed as recommended by Intel. 😞

In good news, Microsoft are releasing the fixed production microcode updates through Windows Update. Currently only for Windows 10 and Skylake, other CPUs (but not other O/S) will be added.
https://support.microsoft.com/en-us/help/4090007


Later intel said the initial released microcode (version C2) for SKYLAKE H/S U/Y etc didn't had any problem and was ok to use, so bios updated for these skylakes C2*** are ok.
But you a right for any other CPU than the skylake C2*** models, for all the others the initial released MC needs to be fixed/upgraded.

https://newsroom.intel.com/wp-content/uploads/sites/11/2018/03/microcode-update-guidance.pdf
"Lines with “***” were previously recommended to discontinue use. Subsequent testing by Intel has determined that these were unaffected by the stability issues and have been re-released without modification."

Mr.Wolf wrote:
Later intel said the initial released microcode (version C2) for SKYLAKE H/S U/Y etc didn't had any problem and was ok to use, so bios updated for these skylakes C2*** are ok.
But you a right for any other CPU than the skylake C2*** models, for all the others the initial released MC needs to be fixed/upgraded.

https://newsroom.intel.com/wp-content/uploads/sites/11/2018/03/microcode-update-guidance.pdf
"Lines with “***” were previously recommended to discontinue use. Subsequent testing by Intel has determined that these were unaffected by the stability issues and have been re-released without modification."

Thanks, that is really useful info and something which seems to have gone completely unreported. The comms around this issue has been dreadful, Intel said stop using the update and the press announced the same (re)release as a new stable update.