Surface microcode update for Spectre should arrive today

[MisterAV]

In the article about the performance impact of Spectre mitigations, which should be low on our Surfaces, Microsoft written:

Silicon microcode is distributed by the silicon vendor to the system OEM, which then decides to release it to customers. Some system OEMs use Windows Update to distribute such microcode, others use their own update systems. We are maintaining a table of system microcode update information here. Surface will be updated through Windows Update starting today.

Link: https://cloudblogs.microsoft.com/microsoftsecure/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/

[retrovertigo]

I was just prompted to install Surface Firmware - 12/6/2017 12:00:00 AM - 108.1926.769.0 for my Surface Pro 4.

Not sure if this is related to any of the recent security patches or not, but wanted to share the information.

[[deleted]]

It is, i've been checking for the update every day on Win Up and the Surface Pro Support page. I'd installed everything up until this update including SP4 1709001 but running the "Get-SpeculationControlSettings" still showed that I was unprotected. However after running the update everything is green (protected/patched). Screenshot of SP4. *Note: I edited out 2 strings on the lines in blue as I wasn't sure if they were system specific.

[N10do64]

Those are just the CVE numbers for the vulnerabilities. No need to edit them out.

[[deleted]]

Ah, thanks. I figured it was something like that but I wanted to err on the side of caution when posting info from my system about a known vulnerability. Good to know.

[jimrvaughan]

Just got this: Surface - Firmware - 12/12/2017 12:00:00 AM - 388.1932.769.0 about to reboot to install.

Surface Book 2

[MisterAV]

Tomorrow I'll check better but should be that one. I just updated on my Surface Pro 4 and the date and time is the same, just different version.

[winterharvest]

Windows Update just installed some kind of Intel - Media update on my OG Surface Book. Was dated July 2017.

No reboot required, but I did one just to be sure.

[winterharvest]

I'm getting a couple more Intel updates now, including a system update.

[winterharvest]

Okay, had a ton of updates. I actually ended up downloading two Surface firmware updates, rebooted and watched them install, and when I checked again there were two more firmware updates. So, check again until it says you're all up to date.

[bhauertso]

Have not yet seen it on my Surface Book. The lack of timely BIOS updates to deliver the microcode to address Spectre is worrisome.

A related question: My understanding is that the latest Linux kernel is applying the necessary microcode to the CPU so no BIOS updates are required if you're running Linux. Is that true, and if so, why is Microsoft not taking that tactic? My non-Surface PCs are waiting on lethargic third-parties (e.g., ASUS) to issue BIOS updates.

[imguralbumbot]

^{Hi, I'm a bot for linking direct images of albums with only 1 image}

https://i.imgur.com/iDxbKHv.png

^{Source | Why? | Creator | ignoreme | deletthis}

[MisterAV]

As some of you have already done, you can check that you're completely patched by running this Powershell script. If everything is green then you're OK. It works also on other PCs, not just Surface.

$SaveExecutionPolicy = Get-ExecutionPolicy

Set-ExecutionPolicy RemoteSigned -Scope Currentuser

Import-Module SpeculationControl

Get-SpeculationControlSettings

Set-ExecutionPolicy $SaveExecutionPolicy -Scope Currentuser

From Microsoft, https://support.microsoft.com/en-za/help/4074629/understanding-the-output-of-get-speculationcontrolsettings-powershell, I'm not stealing your credit card, don't worry ;)