KB4073119: Windows client guidance for IT Pros to protect against silicon-based microarchitectural and speculative execution side-channel vulnerabilities

On May 14, 2019, Intel published information about a new subclass of speculative execution side-channel vulnerabilities known as Microarchitectural Data Sampling. These vulnerabilities are addressed in the following CVEs:

• CVE-2019-11091 | Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

• CVE-2018-12126 | Microarchitectural Store Buffer Data Sampling (MSBDS)

• CVE-2018-12127 | Microarchitectural Fill Buffer Data Sampling (MFBDS)

• CVE-2018-12130 | Microarchitectural Load Port Data Sampling (MLPDS)

We have released updates to help mitigate these vulnerabilities. To get all available protections, firmware (microcode) and software updates are required. This may include microcode from device OEMs. In some cases, installing these updates will have a performance impact. We have also acted to secure our cloud services. We strongly recommend deploying these updates.

For more information about this issue, see the following Security Advisory and use scenario-based guidance to determine actions necessary to mitigate the threat:

• ADV190013 | Microsoft Guidance to mitigate Microarchitectural Data Sampling vulnerabilities

• Windows guidance to protect against speculative execution side-channel vulnerabilities

On August 6, 2019 Intel released details about a Windows kernel information disclosure vulnerability. This vulnerability is a variant of the Spectre Variant 1 speculative execution side-channel vulnerability and has been assigned CVE-2019-1125.

On July 9, 2019 we released security updates for the Windows operating system to help mitigate this issue. Please note that we held back documenting this mitigation publicly until the coordinated industry disclosure on Tuesday, August 6, 2019.

Customers who have Windows Update enabled and have applied the security updates released on July 9, 2019 are protected automatically. There is no further configuration necessary.

For more information about this vulnerability and applicable updates, see the Microsoft Security Update Guide:

• CVE-2019-1125 | Windows Kernel Information Disclosure Vulnerability

On November 12, 2019, Intel published a technical advisory around Intel Transactional Synchronization Extensions (Intel TSX) Transaction Asynchronous Abort vulnerability that is assigned CVE-2019-11135. We have released updates to help mitigate this vulnerability. By default, the OS protections are enabled for Windows Client OS editions.

On June 14 2022, we published ADV220002 | Microsoft Guidance on Intel Processor MMIO Stale Data Vulnerabilities. Thes vulnerabilities are assigned in the following CVEs:

• CVE-2022-21123 | Shared Buffer Data Read (SBDR)

• CVE-2022-21125 | Shared Buffer Data Sampling (SBDS)

• CVE-2022-21127 | Special Register Buffer Data Sampling Update (SRBDS Update)

• CVE-2022-21166 | Device Register Partial Write (DRPW)

Recommended actions

You should take the following actions to help protect against these vulnerabilities:

1. Apply all available Windows operating system updates, including the monthly Windows security updates.

2. Apply the applicable firmware (microcode) update that is provided by the device manufacturer.

3. Evaluate the risk to your environment based on the information that is provided in Microsoft Security Advisories ADV180002, ADV180012, ADV190013, and ADV220002, in addition to the information provided in this article.

4. Take action as required by using the advisories and registry key information that are provided in this article.

On July 12, 2022, we published CVE-2022-23825 | AMD CPU Branch Type Confusion which describes that aliases in the branch predictor may cause certain AMD processors to predict the wrong branch type. This issue might potentially lead to information disclosure.

To help protect against this vulnerability, we recommend installing Windows updates that are dated on or after July 2022 and then take action as required by CVE-2022-23825 and registry key information that is provided in this knowledge base article.

For more information, see the AMD-SB-1037 security bulletin.

On August 8, 2023, we published CVE-2023-20569 | AMD CPU Return Address Predictor (also known as Inception) which describes a new speculative side channel attack that can result in speculative execution at an attacker-controlled address. This issue affects certain AMD processors and might potentially lead to information disclosure.

To help protect against this vulnerability, we recommend installing Windows updates that are dated on or after August 2023 and then take action as required by CVE-2023-20569 and registry key information that is provided in this knowledge base article.

For more information, see the AMD-SB-7005 security bulletin.

On April 9, 2024 we published CVE-2022-0001 | Intel Branch History Injection which describes Branch History Injection (BHI) which is a specific form of intra-mode BTI. This vulnerability occurs when an attacker may manipulate branch history before transitioning from user to supervisor mode (or from VMX non-root/guest to root mode). This manipulation could cause an indirect branch predictor to select a specific predictor entry for an indirect branch, and a disclosure gadget at the predicted target will transiently execute. This may be possible because the relevant branch history may contain branches taken in previous security contexts, and in particular, other predictor modes.

By default, user-to-kernel protection for CVE-2017-5715 is disabled for AMD and ARM CPUs. You must enable the mitigation to receive additional protections for CVE-2017-5715. For more information, see FAQ #15 in ADV180002 for AMD processors and FAQ #20 in ADV180002 for ARM processors.

By default, user-to-kernel protection for CVE-2017-5715 is disabled for AMD processors. Customers must enable the mitigation to receive additional protections for CVE-2017-5715.  For more information, see FAQ #15 in ADV180002.

To enable the mitigation for CVE-2022-23825 on AMD processors :

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 16777280 /f 

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f 

To be fully protected, customers might also need to disable Hyper-Threading (also known as Simultaneous Multi Threading (SMT)). Please see KB4073757 for guidance on protecting Windows devices. 

To enable the mitigation for CVE-2023-20569 on AMD processors:

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 67108928 /f

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f 

To enable the mitigation for CVE-2022-0001 on Intel processors:

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 0x00800000 /f

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 0x00000003 /f

For a detailed explanation of the output of the PowerShell script, please see KB4074629.

The microcode is delivered through a firmware update. You should check with your CPU (chipset) and device manufacturers on availability of applicable firmware security updates for their specific device, including Intels Microcode Revision Guidance.

Addressing a hardware vulnerability through a software update presents significant challenges. Also, mitigations for older operating systems require extensive architectural changes. We are working with affected chip manufacturers to determine the best way to provide mitigations, which may be delivered in future updates.

Updates for Microsoft Surface devices will be delivered to customers through Windows Update together with the updates for the Windows operating system. For a list of available Surface device firmware (microcode) updates, see KB4073065.

If your device is not from Microsoft, apply firmware from the device manufacturer. For more information, contact the OEM device manufacturer.

In February and March 2018, Microsoft released added protection for some x86-based systems. For more information see KB4073757 and the Microsoft Security Advisory ADV180002.

Updates to Windows 10 for HoloLens are available to HoloLens customers through Windows Update.

After applying the February 2018 Windows Security Update, HoloLens customers do not have to take any additional action to update their device firmware. These mitigations will also be included in all future releases of Windows 10 for HoloLens.

No. Security Only updates are not cumulative. Depending on the operating system version you are running, you will have to install every monthly Security Only updates to be protected against these vulnerabilities. For example, if you are running Windows 7 for 32-bit Systems on an affected Intel CPU you must install all of the Security Only updates. We recommend installing these Security Only updates in the order of release.

Note An earlier version of this FAQ incorrectly stated that the February Security Only update included the security fixes released in January. In fact, it does not.

No. Security update 4078130 was a specific fix to prevent unpredictable system behaviors, performance issues, and/or unexpected reboots after installation of microcode. Applying the February security updates on Windows client operating systems enables all three mitigations.

Intel recently announced they have completed their validations and started to release microcode for newer CPU platforms. Microsoft is making available Intel validated microcode updates around Spectre Variant 2 (CVE-2017-5715 "Branch Target Injection"). KB4093836 lists specific Knowledge Base articles by Windows version. Each specific KB contains the available Intel microcode updates by CPU.

This issue was resolved in KB4093118.

AMD recently announced they have started to release microcode for newer CPU platforms around Spectre Variant 2 (CVE-2017-5715 "Branch Target Injection"). For more information refer to the AMD Security Updates and AMD Whitepaper: Architecture Guidelines around Indirect Branch Control. These are available from the OEM firmware channel.

We are making available Intel validated microcode updates around Spectre Variant 2 (CVE-2017-5715 “Branch Target Injection ”). To get the latest Intel microcode updates through Windows Update, customers must have installed Intel microcode on devices running a Windows 10 operating system prior to upgrading to the Windows 10 April 2018 Update (version 1803).

The microcode update is also available directly from Catalog if it was not installed on the device prior to upgrading the OS. Intel microcode is available through Windows Update, WSUS, or the Microsoft Update Catalog. For more information and download instructions, see KB4100347.

For more information, see the following resources:

• ADV180012 | Microsoft Guidance for Speculative Store Bypass for CVE-2018-3639

• ADV180013 | Microsoft Guidance for Rogue System Register Read for CVE-2018-3640 and KB4073065

• Microsoft Security Research and Defense Blog

• Developer Guidance for Speculative Store Bypass

For details, see the “Recommended actions” and “FAQ” sections in  ADV180012 | Microsoft Guidance for Speculative Store Bypass.

To verify the status of SSBD, the Get-SpeculationControlSettings PowerShell script was updated to detect affected processors, status of the SSBD operating system updates, and state of the processor microcode if applicable. For more information and to obtain the PowerShell script, see KB4074629.

On June 13, 2018, an additional vulnerability involving side-channel speculative execution, known as Lazy FP State Restore, was announced and assigned CVE-2018-3665. No configuration (registry) settings are necessary for Lazy Restore FP Restore.

For more information about this vulnerability and for recommended actions, refer to security advisory ADV180016 | Microsoft Guidance for Lazy FP State Restore.

Bounds Check Bypass Store (BCBS) was disclosed on July 10, 2018 and assigned CVE-2018-3693. We consider BCBS to belong to the same class of vulnerabilities as Bounds Check Bypass (Variant 1). We are not currently aware of any instances of BCBS in our software, but we are continuing to research this vulnerability class and will work with industry partners to release mitigations as required. We continue to encourage researchers to submit any relevant findings to Microsoft’s Speculative Execution Side Channel bounty program, including any exploitable instances of BCBS. Software developers should review the developer guidance that was updated for BCBS at https://aka.ms/sescdevguide.

On August 14, 2018,  L1 Terminal Fault (L1TF) was announced and assigned multiple CVEs. These new speculative execution side-channel vulnerabilities can be used to read the content of memory across a trusted boundary and, if exploited, can lead to information disclosure. An attacker could trigger the vulnerabilities through multiple vectors, depending on the configured environment. L1TF affects Intel® Core® processors and Intel® Xeon® processors.

For more information about this vulnerability and a detailed view of affected scenarios, including Microsoft's approach to mitigating L1TF,  see the following resources:

• ADV180018 | Microsoft Guidance to mitigate L1TF variant

• Security Advisory Security Research Blog

• Server Guidance for L1 Terminal Fault

Customers using 64-bit ARM processors should check with the device OEM for firmware support because ARM64 operating system protections that mitigate CVE-2017-5715 | Branch target injection (Spectre, Variant 2) require the latest firmware update from device OEMs to take effect.

For more information, refer to the following security advisories 

• Intel’s Security Advisory

• ADV190013 | Microsoft Guidance to mitigate Microarchitectural Data Sampling vulnerabilities

For more information, refer to the following security advisories

• Intel’s Security Advisory

• ADV190013 | Microsoft Guidance to mitigate Microarchitectural Data Sampling vulnerabilities

Further guidance can be found in Windows guidance to protect against speculative execution side-channel vulnerabilities

Please refer to the guidance in Windows guidance to protect against speculative execution side-channel vulnerabilities

For Azure guidance, please refer to this article: Guidance for mitigating speculative execution side-channel vulnerabilities in Azure.  

For more information about Retpoline enablement, refer to our blog post: Mitigating Spectre variant 2 with Retpoline on Windows. 

For details about this vulnerability, see the Microsoft Security Guide: CVE-2019-1125 | Windows Kernel Information Disclosure Vulnerability.

We’re not aware of any instance of this information disclosure vulnerability affecting our cloud service infrastructure.

As soon as we became aware of this issue, we worked quickly to address it and release an update. We strongly believe in close partnerships with both researchers and industry partners to make customers more secure, and did not publish details until Tuesday, August 6, consistent with coordinated vulnerability disclosure practices.

Further guidance can be found in Windows guidance to protect against speculative execution side-channel vulnerabilities.

Further guidance can be found in Windows guidance to protect against speculative execution side-channel vulnerabilities.

Further guidance can be found in Guidance for disabling Intel® Transactional Synchronization Extensions (Intel® TSX) capability.

We provide third-party contact information to help you find technical support. This contact information may change without notice. We do not guarantee the accuracy of this third-party contact information.