Intel’s security patch for Spectre variant 2 (CVE-2017-5715 Branch Target Injection) was so faulty that the company itself asked the users not to install the patches.
After Intel publicly admitted that the microcode patch “may introduce higher than expected reboots and other unpredictable system behavior” and it may lead to “data loss or corruption”, Microsoft decided to disable the mitigation patch for Spectre variant 2 bug by pushing another update until Intel develops a more stable fix.
Microsoft released this counter patch on Saturday for all the Windows 7 SP1, Windows 8.1, Windows 10 (all versions), for client and server i.e a week after Intel’s statement.
The KB4078130 update will download automatically through windows update. The users can also download it from the Microsoft Update Catalog website. Microsoft is also providing instructions for advanced users to manually disable and enable the mitigation against Spectre Variant 2 via registry setting changes. The instructions are made available for desktops and servers.
The company also mentions that there haven’t been any reports of attacks using Spectre variant 2 til now. And until Intel issues a stable patch for the bug, windows users can install the KB4078130 update to prevent unexpected reboots.
Intel says, they have found the root cause for the Broadwell and Haswell platforms and the company has already started rolling out the early version of the updated solution over the weekend to its OEM partners for testing. Based on the testing, the final version of the update will be released.
There are other companies too which have rollbacked the Spectre patch which include Dell that asked the customers to “revert back to a previous BIOS versions” and HP which reissued the BIOS updates only for Meltdown and Spectre Variant 1 patches, but not Variant 2.
While installing the updates, make sure that they are from the right source, as we have already seen fake meltdown and Spectre patches pushing smokeloader malware to pcs.
