Windows 10 V1809: Enable Retpoline Spectre V2 Protection

On November 12, 2019, Intel published a technical advisory around Intel® Transactional Synchronization Extensions (Intel TSX) Transaction Asynchronous Abort vulnerability that is assigned CVE-2019-11135. Microsoft has released updates to help mitigate this vulnerability and the OS protections are enabled by default for Windows Server 2019 but disabled by default for Windows Server 2016 and earlier Windows Server OS editions.

By default, user-to-kernel protection for CVE-2017-5715 is disabled for AMD CPUs. Customers must enable the mitigation to receive additional protections for CVE-2017-5715. For more information, see FAQ #15 in ADV180002.

By default, user-to-kernel protection for CVE-2017-5715 is disabled for AMD processors. Customers must enable the mitigation to receive additional protections for CVE-2017-5715. For more information, see FAQ #15 in ADV180002.

On November 12, 2019, Intel published a technical advisory around Intel Transactional Synchronization Extensions (Intel TSX) Transaction Asynchronous Abort vulnerability that is assigned CVE-2019-11135. We have released updates to help mitigate this vulnerability. By default, the OS protections are enabled for Windows Client OS editions.

By default, user-to-kernel protection for CVE-2017-5715 is disabled for AMD and ARM CPUs. You must enable the mitigation to receive additional protections for CVE-2017-5715. For more information, see FAQ #15 in ADV180002 for AMD processors and FAQ #20 in ADV180002 for ARM processors.

To check if retpoline and import optimizations are enabled, you can use the PowerShell cmdlet Get-SpeculationControlSettings. You can also use NtQuerySystemInformation to programmatically query retpoline status.

The Spectre and Meltdown vulnerabilities discovered in January 2018 showed that weaknesses in CPUs were a potential attack vector. They allow a rogue process to read memory without authorization. Patches were rolled out along with bios updates from the manufacturer, but they came with a costly side effect: They degraded performance, especially on systems with older CPUs. Microsoft enabled the protections by default on workstations, but not on server platforms.

Then you will need to decide if you will enable protections. Due to performance hits, Microsoft has enabled the protection on workstations by default, but left the decision up to you on server platforms. To enable these protections (or disable them) on workstations, follow the guidance provided by Microsoft in KB4073119. To enable these protections on Windows Server platforms, follow the guidance in KB4072698. You may need to review various tech sites as to the tested performance hits after the patches have been installed.

Make the following registry settings to enable these MDS protections: (CVE-2018-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130. You can also use these settings for Spectre (CVE-2017-5753 and CVE-2017-5715), Meltdown (CVE-2017-5754), and variants including Speculative Store Bypass Disable (SSBD) (CVE-2018-3639) and L1 Terminal Fault (L1TF) (CVE-2018-3615, CVE-2018-3620 and CVE-2018-3646) without disabling hyper-threading:

What does all this mean for performance though? Well, according to Microsoft and its internal testing, the company saw approximately 25% faster Microsoft Office application startup times and between a 1.5 to 2-times increase in storage and networking performance which is a notable improvement post-Spectre 2 patches. They also claimed that the performance impact has been "reduced to noise level for most situations." If you are running Windows Insider Preview 18272 or later on supporting hardware the retpoline optimizations should already be turned on for you (you can double check with PowerShell cmdlet Get-SpeculationControlSettings) and if you are running Windows 10 1809 or later the optimizations will be enabled within the first half of this year in a phased rollout. 2b1af7f3a8

Windows 10 V1809: Enable Retpoline Spectre V2 Protection

Subscribe Form