Intel Updates Microcode Guide To Address Meltdown Attacks

Intel this week released an updated "Microcode Revision Guidance" document (PDF) that includes more detailed information about the state of its firmware patches to address potential Meltdown and Spectre attack scenarios.

The chipmaker additionally noted in an announcement that it has "released production microcode to our OEM [original equipment manufacturer] customers" for processors using its Coffee Lake, Kaby Lake and additional Skylake technologies. Intel is addressing sixth-, seventh- and eighth-generation processors now, plus Intel Core X. It's also addressing Xeon Scalable and Xeon D processors for datacenters.

Meltdown and Spectre are attack methods demonstrated publicly by researchers in January that affect most computer processors. Addressing these vulnerabilities involves applying a firmware (or microcode) patch to the CPU and also an operating system update to Windows and Linux systems.

Typically, the microcode patches from the chip vendors get tested by OEMs first before public release, but these releases haven't been without problems. For instance, there have been bricked AMD-based machines after Windows updates, and there have been reboot problems associated with Intel-based machines after some microcode updates were applied.

Intel's updated "Microcode Revision Guidance" perhaps will be helpful for IT pros. They need to check which microcode updates were approved for "production" use by the OEMs, which typically are computer makers such as Dell, HP, Toshiba and the like. In some cases, if their computer vendor isn't deemed to be an OEM (that is, it's just a PC builder that puts together computer parts), then they'll have to get approved microcode updates from the CPU makers, such as AMD, Intel, Nvidia and more. In that case, the key information to go by for Intel chip users is the "Production Status" column in Intel's guidance document.

The patches released so far typically have been for Meltdown attack scenarios. Spectre is considered to be a harder problem for the computer industry to fix, and the released patches may not be addressing it. While malware using the techniques hadn't been detected "in the wild" by researchers who disclosed the techniques back in January, AV-Test detected some malware samples earlier this month that could be using the techniques.

Organizations likely will have tracking burdens regarding the OS and microcode updates for Meltdown and Spectre. Microsoft recently added some Meltdown and Spectre update tracking capabilities into its Windows Analytics tool for organizations to that end, but using it involves permitting some "telemetry" information sharing. The updates, when applied, will have the effect of slowing down systems in some cases, depending on the workload.

About the Author

Kurt Mackie is senior news producer for the 1105 Enterprise Computing Group.


  • How To Create a Windows Deployment Image, Part 1

    While there are various methods for creating custom Windows deployment images, the process has a reputation for being tedious and convoluted.

  • Azure Cost Management Now Commercially Available for Some Tenancies

    Microsoft on Monday announced that its Azure Cost Management feature had reached the "general availability" release stage for both Azure "pay-as-you-go" customers and Azure Government tenancies.

  • Microsoft Bringing Files Restore Capability to SharePoint Online and Teams

    Microsoft on Monday announced that it's delivering its Files Restore feature for SharePoint Online and Microsoft Teams to Office 365 tenancies as early as this month.

  • Microsoft Nabs IoT Platform Provider Express Logic

    As part of its plan to invest $5 billion in IoT technologies, Microsoft this week acquired Express Logic, which provides real-time operating systems for industrial embedded and IoT devices.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.