新浪博客

关于CPU漏洞的安全通告小结-ADV180002,ADV180012,ADV180013,ADV180016

2018-11-30 09:51阅读：

http://blog.sina.cn/dpool/blog/u/1793371113

<原文见https://blogs.technet.microsoft.com/gcrsec/2018/06/19/mitigation_against_speculative_execution_side_channel_vuls/>


截止6月13日（太平洋时间），微软针对6个不同的CPU硬件漏洞发布了4个安全通告（ADV180002, ADV180012, ADV180013，ADV180016），对部分从软件方面提供缓解。
硬件漏洞编号
CVE-2017-5753 (Variant 1): Spectre
CVE-2017-5715 (Variant 2): Spectre
CVE-2017-5754 (Variant 3): Meltdown
CVE-2018-3639 (Variant 4): Speculative Store Bypass (SSB)
CVE-2018-3640 (Variant 3a): Rogue System Register Read
CVE-2018-3665: Lazy FP State Restore
微软安全通告
ADV180002 | Guidance to mitigate speculative execution side-channel vulnerabilities (CVE-2017-5753, CVE-2017-5715, CVE-2017-5754)
ADV180012 | Microsoft Guidance for Speculative Store Bypass
(CVE-2018-3639)
ADV180013 | Microsoft Guidance for Rogue System Register Read (CVE-2018-3640)
ADV180016 | Microsoft Guidance for Lazy FP State Restore (CVE-2018-3665)
当前防护状态和默认设置
Operating System CVE-2017-5715 (ADV180002) CVE-2017-5754 (ADV180002) CVE-2018-3639 (ADV180012)
Windows 10 Enabled by default Enabled by default Disabled by default - see ADV180012
Windows Server 2016 Disabled by default - see KB4072698 Disabled by default - see KB4072698 Disabled by default - see ADV180012
Windows 8.1 Enabled by default Enabled by default Not available - see ADV180012
Windows Server 2012 R2 Disabled by default - see KB4072698 Disabled by default - see KB4072698 Not available - see ADV180012
Windows RT 8.1 Enabled by default Enabled by default Not available - see ADV180012
Windows 7 Enabled by default Enabled by default Disabled by default - see ADV180012
Windows Server 2008 R2 Disabled by default - see KB4072698 Disabled by default - see KB4072698 Disabled by default - see ADV180012
Windows Server 2008 Disabled by default - see KB4072698 Disabled by default - see KB4072698 Not available - see ADV180012
* 针对CVE-2018-3639 (Variant 4) 和 CVE-2018-3640 (Variant 3a) 也需要微码更新。

相关链接
https://blogs.technet.microsoft.com/srd/2018/03/15/mitigating-speculative-execution-side-channel-hardware-vulnerabilities/
https://blogs.technet.microsoft.com/srd/2018/03/23/kva-shadow-mitigating-meltdown-on-windows/
https://blogs.technet.microsoft.com/srd/2018/05/21/analysis-and-mitigation-of-speculative-store-bypass-cve-2018-3639/
https://blogs.msdn.microsoft.com/vcblog/2018/01/15/spectre-mitigations-in-msvc/
https://docs.microsoft.com/en-us/cpp/security/developer-guidance-speculative-execution

我的更多文章

下载客户端阅读体验更佳

APP专享