i粉都喜歡扣別人帽子 :laugh:

There were three vulnerabilities revealed Wednesday (Common Vulnerabilities and Exposures number):

1. Bounds Check Bypass (CVE-2017-5753)
2. Branch Target Injection (CVE-2017-5715)
3. Rogue Data Load (CVE-2017-5754)

The bounds check bypass (threat No. 1) has a software fix because its difficult to change the CPU design to eliminate the speculative execution. During a rare briefing with AMD, ARM and Intel, all three companies said this was a shared threat and was being address through system software changes. It appears the performance impact is negligible.

The impact of threats No. 2 and No. 3 do vary depending on CPU vendor. Intel has confirmed both threats, but AMD has said that it cannot observe No. 2 and that, by design, it is not vulnerable to No. 3. This may be because Intel has used more aggressive techniques in its speculative operations. Each vendor has a different branch target design and this can impact the vulnerability. These are also the threats with the most performance impacts.

Intel said threat No. 2 may slow performance on benchmarks by 0-5 percent. Threat No. 3 may see an impact on typical workloads of between 3-5 percent, software that accesses kernel services a lot will bear the brunt of the slow down.

上FIX先

Win7 KB4056897
Win8.1 KB4056898
Win10 1507 KB4056893
Win10 1511 KB4056888
Win10 1607 KB4056890
Win10 1703 KB4056891
Win10 1709 KB4056892

把第一個拉進來混淆視聽 實在是高明的公關手法 :laugh:

如果是__的呢? :D
那麼多年十幾代下來,全世界最頂尖幾百人的CPU團隊竟沒人做驗証時查出這個東西
該不會是上面有高人指示"不小心"放的吧
現在網路上留言滿天飛
illuminati啦/猶太人啦/NSA啦/CIA啦/外星人拉......etc :laugh: :D

雞排備好,旁邊看熱鬧先

話說這個CEO也差不多該下台了,10nm卡彈那麼久
虧他年輕時還是研發製程出身的 :unbelief:
server這麼肥的市場真的因為這次事件被競對手打進來的話,飯碗大概不保

https://www.ptt.cc/bbs/PC_Shopping/...9361.A.EA8.html

從對岸看到的討論

微軟已經推出修正補丁，可以等待Windows更新自動推送，
不過因為系統內核大幅修改的關係，
補丁可能會和防毒軟體或其他應用相衝突引發藍屏，
可以先查詢使用的軟體的相容性情況。

使用Windows 10 版本 1709的用戶需要打KB4056892
https://support.microsoft.com/en-us...pdate-kb4056892
使用Windows 10 LTSB 2016的用戶需要打KB4056890
https://support.microsoft.com/en-us...pdate-kb4056890
Windows 8.1打KB4056898
https://support.microsoft.com/en-us...pdate-kb4056898
Windows 7打KB4056897
https://support.microsoft.com/en-us...pdate-kb4056897

打完補丁後檢查系統是否啟用Kernel VA Shadowing

管理員權限運行PowerShell執行
Install-Module SpeculationControl
安裝管理模組 之後運行
Get-SpeculationControlSettings

圖例AMD A10-5757M打完補丁會顯示

因為AMD處理器不存在Meltdown弱點，所以Kernel VA Shadowing保持關閉

圖例Intel i5-4590

Kernel VA Shadowing會打開

原文：http://bbs.ngacn.cc/read.php?tid=13191483



yksoft1製作的Spectre漏洞PoC
https://www.v2ex.com/t/420141

原始碼截圖



在i5-4590 WIN10 打了Meltdown補丁的系統上執行

讀出了「非洲必須要用金坷垃！！！！」內容，Spectre爆破成功。

在A10-5757M WIN10 打了Meltdown補丁的系統上執行

沒有讀出內容來，Spectre爆破失敗。


這個代碼本身是通用的 不針對特定平台，
雖然在一些極其古老的機器上因為缺指令集的關係跑不起來。
所以從這個PoC的情況看，
農企的處理器尤其是農機系列確實受Spectre漏洞的影響較小。

原文：http://bbs.ngacn.cc/read.php?tid=13191988

Win10 1703 KB4056891

更新前後CPU-Z跑分
似乎沒甚麼區別 分數還變高這怎麼回事@@? :jolin:
https://i.imgur.com/KUywMQI.jpg

目前的筆電用A8-5545M
想說還有其他用類似型號的APU原來是圖例而已

軟軟的更新檔要上了, 但是有可能會跟防毒軟體相衝突...
轉載Ptt PC_Shopping
更新前先確認一下吧!!

更新完 ASUS 的 Aisuite3 先GG惹，其他目前正常