关于CPU漏洞的安全通告小结-ADV180002,ADV180012,ADV180013,ADV180016


截止6月13日(太平洋时间),微软针对6个不同的CPU硬件漏洞发布了4个安全通告(ADV180002, ADV180012, ADV180013,ADV180016),对部分从软件方面提供缓解。

硬件漏洞编号

CVE-2017-5753 (Variant 1): Spectre

CVE-2017-5715 (Variant 2): Spectre

CVE-2017-5754 (Variant 3): Meltdown

CVE-2018-3639 (Variant 4): Speculative Store Bypass (SSB)

CVE-2018-3640 (Variant 3a): Rogue System Register Read

CVE-2018-3665: Lazy FP State Restore

微软安全通告

ADV180002 | Guidance to mitigate speculative execution side-channel vulnerabilities (CVE-2017-5753, CVE-2017-5715, CVE-2017-5754)

ADV180012 | Microsoft Guidance for Speculative Store Bypass (CVE-2018-3639)

ADV180013 | Microsoft Guidance for Rogue System Register Read (CVE-2018-3640)

ADV180016 | Microsoft Guidance for Lazy FP State Restore (CVE-2018-3665)

当前防护状态和默认设置

Operating System CVE-2017-5715 (ADV180002) CVE-2017-5754 (ADV180002) CVE-2018-3639 (ADV180012)
Windows 10 Enabled by default Enabled by default Disabled by default - see ADV180012
Windows Server 2016 Disabled by default - see KB4072698 Disabled by default - see KB4072698 Disabled by default - see ADV180012
Windows 8.1 Enabled by default Enabled by default Not available - see ADV180012
Windows Server 2012 R2 Disabled by default - see KB4072698 Disabled by default - see KB4072698 Not available - see ADV180012
Windows RT 8.1 Enabled by default Enabled by default Not available - see ADV180012
Windows 7 Enabled by default Enabled by default Disabled by default - see ADV180012
Windows Server 2008 R2 Disabled by default - see KB4072698 Disabled by default - see KB4072698 Disabled by default - see ADV180012
Windows Server 2008 Disabled by default - see KB4072698 Disabled by default - see KB4072698 Not available - see ADV180012

* 针对CVE-2018-3639 (Variant 4) 和 CVE-2018-3640 (Variant 3a) 也需要微码更新。

相关链接

https://blogs.technet.microsoft.com/srd/2018/03/15/mitigating-speculative-execution-side-channel-hardware-vulnerabilities/
https://blogs.technet.microsoft.com/srd/2018/03/23/kva-shadow-mitigating-meltdown-on-windows/
https://blogs.technet.microsoft.com/srd/2018/05/21/analysis-and-mitigation-of-speculative-store-bypass-cve-2018-3639/
https://blogs.msdn.microsoft.com/vcblog/2018/01/15/spectre-mitigations-in-msvc/
https://docs.microsoft.com/en-us/cpp/security/developer-guidance-speculative-execution

Comments (0)

Skip to main content