Share via

Mitigating the last "L1 terminal fault" vulnerabilities - possible or not?

Anonymous
2018-08-15T00:55:43+00:00

Hello,

So I have a 8700K and MSI Z370 with the last BIOS (and also the last, and necessary microcode update - see picture). I have installed the OS patch (Windows 10 x64). Yet the PC is still vulnerable, I can't figure why.

This is from the perspective of a normal Windows 10 user, i.e. client side, no Hyper-X, no SGX (not even installed that as there's no use to it unless you develop stuff, from what I've heard).

What I tried:

  • turning off Hyperthreading - no effect (was suggested as necessary if using Virtualization-Based Security - mine shows as Disabled in msinfo, still gave it a shot)
  • manually enabling SSBD mitigations - that changed the SSBDWindowsSupportEnabledSystemWide flag to True, as expected. Sadly L1TFHardwareVulnerable is also remaining True...

Intel (and Microsoft) are saying that the microcode necessary for L1TF is the same required for SSBD:

Are there mitigations in place?

Yes. The microcode updates released earlier this year when coupled with operating system and hypervisor software updates available now from our industry partners, ensure consumers, IT professionals and cloud service providers have access to the protections they need.

The required microcode is the same microcode that addresses CVE-2018-3639 and CVE-2018-3640.

The last 8700K microcode is Rev 0x96 (see picture as well).

So all the pieces should fall into place, yet they don't. The PC is still found as vulnerable. So... what could be the issue here?

Thanks!

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2018-08-15T14:11:06+00:00

    Hi,

    The post here may help explain how to interpret what "hardware is vulnerable to L1 terminal fault" means: https://support.microsoft.com/en-us/help/4074629/understanding-the-output-of-get-speculationcontrolsettings-powershell

    In short, this line will always report as True if the hardware is believed to be vulnerable to L1 terminal fault, even if the mitigation is enabled. The important part is the line that refers to "L1 terminal fault mitigation is enabled", which in your screenshot reports as True. This indicates that the mitigation is enabled and that this device is protected from CVE-2018-3620.

    Hope that helps,

    Matt Miller

    Microsoft Security Response Center

    I've read that, thanks.

    If what you saying is true, this is a departure from how previous vulnerabilities were described, and just adds confusion. The previous way of doing it made far more sense, you could see if the necessary hardware (microcode) was there and if the mitigation is enabled&working.

    With this formulation, it suggests that the hardware is vulnerable, and that's it. Yes you applied the mitigations, but... hardware is still found to be vulnerable.

    The whole reason we apply these mitigations is to patch the vulnerable hardware and achieve a non-vulnerable state. You don't want to see that you're still vulnerable with all mitigations in place.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2018-08-15T05:41:36+00:00

    Hi,

    The post here may help explain how to interpret what "hardware is vulnerable to L1 terminal fault" means: https://support.microsoft.com/en-us/help/4074629/understanding-the-output-of-get-speculationcontrolsettings-powershell

    In short, this line will always report as True if the hardware is believed to be vulnerable to L1 terminal fault, even if the mitigation is enabled. The important part is the line that refers to "L1 terminal fault mitigation is enabled", which in your screenshot reports as True. This indicates that the mitigation is enabled and that this device is protected from CVE-2018-3620.

    Hope that helps,

    Matt Miller

    Microsoft Security Response Center

    Was this answer helpful?

    0 comments