Microsoft Scrambles To Put A Stop To Intel's Shoddy Spectre Variant 2 Patch

Five things to know about the Xbox One X

Microsoft has rushed out a system update that will disable the sloppy mitigation patch deployed earlier by Intel for Spectre vulnerabilities detected on Windows systems.

Update KB4078130 was delivered in haste to reverse the system instability that Intel's Spectre variant 2 (CVE 2017-5715 Branch Target Injection) could cause. Since withdrawing the patch, the chipmaker has belatedly admitted that PCs that will absorb the update could become less stable.

"Our own experience is that system instability can in some circumstances cause data loss or corruption ... We understand that Intel is continuing to investigate the potential impact of the current microcode version and encourage customers to review their guidance on an ongoing basis to inform their decisions," Microsoft said on the note that accompanied the hastily deployed update.

The company said the system update would apply to all supported OS versions - Windows 7, Windows 8.1, and Windows 10.

The Windows-maker also assured users that as of Jan. 25, there are no indications that the Spectre variant 2 patch has been weaponized for potential hacking attacks.

Security Concerns

As stated by Microsoft, the mitigation system update will deactivate CVE 2017-5715, and the inevitable result is some form of vulnerability. For the moment, the company said the update is a form of compromise for users to retain a better performance level, which is crucial for enterprise users.

There might be a chance, however, that the issue will be corrected on specific system models. In such case, restoring the Spectre 2 variant 2 patch will be the safe thing to do.

"We recommend Windows customers, when appropriate, reenable the mitigation against CVE-2017-5715 when Intel reports that this unpredictable system behavior has been resolved for your device," Microsoft advised.

For majority of Windows users though, installing KB4078130 is the best course available at the moment. For users who require reliability more than anything, security can take the backseat for now. Microsoft continues to monitor the situation, and, so far, exploits based on Intel's Spectre patch do not exist.

Transparency Demanded

Notwithstanding the availability of immediate solutions to Spectre and Meltdown, security experts have scored what they termed as mishandling of the whole affair. Jonathan Corbet, a Linux Foundation technical advisory board member, claimed that the important details on the subject have been deliberately suppressed, which prevented the revelation of the whole story.

The foundation said that had any of the parties observed some amount of transparency about the security issue, corrective and preventive measures would have been better implemented, and that this case should help the industry find a better way of dealing with similar vulnerabilities in the future.

© 2018 Tech Times, All rights reserved. Do not reproduce without permission.

From Our Sponsor

Entropia Universe Allows Players To Earn Real Cash In The Virtual World

Everything in Entropia Universe has real cash value, and the real estate, land and deeds that players invest in are actual investments. The game uses a micropayment system that allows players to buy Project Entropia Dollars (PED), which is used as in-game currency. With a click of a mouse, PED can also be withdrawn from the game and transferred to your bank account using an e-money/e-wallet service like Neteller e-wallet.
Real Time Analytics