Spectre and Meltdown Vulnerabilities

I was viewing this video and he says to to disable the Spectre and Meltdown with this app , he says having these patches enabled can affect your FPS in games. I have disabled these patches as per screenshot attached to my post.

However, it appears the trade-off is less security and increased vulnerabilty. Is it worth having these disabled and will there be any noticeable increase in my FPS (I haven't tested yet) or is not worth it?

Before i explain how to detect the two bugs on your own system, let’s take a moment to fully understand what the two vulnerabilities are and how they work.

The CPU flaw allows a would-be hacker to expose almost any data that a computer processes. That includes passwords, encrypted messages, personal information, and anything else you can think of.

Meltdown only affects Intel processors. Worryingly, the bug has been present since 2011. It uses part of the out-of-order execution (OOOE) process to change the cache state of a CPU. It can then dump the contents of the memory when it usually would be inaccessible.

Spectre can attack Intel, AMD, and ARM processors, and can thus also affect phones, tablets, and smart devices. It uses a processor’s speculative execution and branch prediction in conjunction with cache attacks to trick apps into revealing information that should be hidden within the protected memory area.

Spectre attacks need to be customized on a machine-by-machine basis, meaning they are harder to execute. However, because it’s based on an established practice in the industry, it’s also harder to fix.


Microsoft has made available a PowerShell script that will quickly tell you whether your PC is protected or not. Running it will require the Powershell, but the process is easy to follow.

If you’re using Windows 7, you will first need to download the Windows Management Framework 5.0 software, which will install a newer version of PowerShell on your system. The script below won’t run properly without it. If you’re using Windows 10, you already have the latest version of PowerShell installed.

First, run PowerShell as an administrator: press Windows key + Q or open the Start Menu, type PowerShell, right-click the first result Windows PowerShell, and select Run as administrator.

1. Type the following command into the PowerShell prompt and press Enter key to install the script on your system.




2. If you’re prompted to install the NuGet provider, type “y” and press Enter. You may also have to type “y” again and press Enter key to trust the software repository.



3. Execute following commands one at a time.



4. Type “y” and press Enter key when you’re asked to confirm.



5. Then, to actually run the script, execute the following commands one at a time:





The screenshot above, the command tells me that I have the Windows patch, but not the UEFI/BIOS update.

To fully protect against Meltdown and Spectre, you’ll need to install a UEFI or BIOS update from your PC’s manufacturer as well as the various software patches. These UEFI updates contain new Intel or AMD processor microcode that adds additional protection against these attacks. Unfortunately, they aren’t distributed via Windows Update—unless you’re using a Microsoft Surface device—so they must be downloaded from your manufacturer’s website and installed manually.

If “Windows OS support for branch target injection mitigation is present” is false, that means your PC hasn’t yet installed the operating system update that protects against these attacks.

Install all important Windows updates, if no updates are found, your antivirus software may be causing the problem, as Windows won’t install it if your antivirus software isn’t yet compatible. Contact your antivirus software provider and ask for more information about when their software will be compatible with the Meltdown and Spectre patch in Windows. This spreadsheet shows which antivirus software has been updated for compatibility with the patch.

You also need to install latest versions of your web browsers. If you use Microsoft Edge or Internet Explorer, the patch is included in the Windows Update. For Google Chrome and Mozilla Firefox, you’ll need to ensure you have the latest version—these browsers automatically update themselves unless you’ve gone out of your way to change that, so most users won’t have to do much.

Patches are now available to protect against Meltdown and Spectre on a wide variety of devices

FreeBooter said:

Before i explain how to detect the two bugs on your own system, let’s take a moment to fully understand what the two vulnerabilities are and how they work.

The CPU flaw allows a would-be hacker to expose almost any data that a computer processes. That includes passwords, encrypted messages, personal information, and anything else you can think of.

Meltdown only affects Intel processors. Worryingly, the bug has been present since 2011. It uses part of the out-of-order execution (OOOE) process to change the cache state of a CPU. It can then dump the contents of the memory when it usually would be inaccessible.

Spectre can attack Intel, AMD, and ARM processors, and can thus also affect phones, tablets, and smart devices. It uses a processor’s speculative execution and branch prediction in conjunction with cache attacks to trick apps into revealing information that should be hidden within the protected memory area.

Spectre attacks need to be customized on a machine-by-machine basis, meaning they are harder to execute. However, because it’s based on an established practice in the industry, it’s also harder to fix.


Microsoft has made available a PowerShell script that will quickly tell you whether your PC is protected or not. Running it will require the Powershell, but the process is easy to follow.

If you’re using Windows 7, you will first need to download the Windows Management Framework 5.0 software, which will install a newer version of PowerShell on your system. The script below won’t run properly without it. If you’re using Windows 10, you already have the latest version of PowerShell installed.

First, run PowerShell as an administrator: press Windows key + Q or open the Start Menu, type PowerShell, right-click the first result Windows PowerShell, and select Run as administrator.

1. Type the following command into the PowerShell prompt and press Enter key to install the script on your system.

Code:

Install-Module SpeculationControl

5. Then, to actually run the script, execute the following commands one at a time:

Code:

Import-Module SpeculationControl

Code:

Get-SpeculationControlSettings

The screenshot above, the command tells me that I have the Windows patch, but not the UEFI/BIOS update.

To fully protect against Meltdown and Spectre, you’ll need to install a UEFI or BIOS update from your PC’s manufacturer as well as the various software patches. These UEFI updates contain new Intel or AMD processor microcode that adds additional protection against these attacks. Unfortunately, they aren’t distributed via Windows Update—unless you’re using a Microsoft Surface device—so they must be downloaded from your manufacturer’s website and installed manually.

If “Windows OS support for branch target injection mitigation is present” is false, that means your PC hasn’t yet installed the operating system update that protects against these attacks.

Install all important Windows updates, if no updates are found, your antivirus software may be causing the problem, as Windows won’t install it if your antivirus software isn’t yet compatible. Contact your antivirus software provider and ask for more information about when their software will be compatible with the Meltdown and Spectre patch in Windows. This spreadsheet shows which antivirus software has been updated for compatibility with the patch.

You also need to install latest versions of your web browsers. If you use Microsoft Edge or Internet Explorer, the patch is included in the Windows Update. For Google Chrome and Mozilla Firefox, you’ll need to ensure you have the latest version—these browsers automatically update themselves unless you’ve gone out of your way to change that, so most users won’t have to do much.

Patches are now available to protect against Meltdown and Spectre on a wide variety of devices

Click to expand...

There is no newer bios on Gigabytes website for my Mobo. I have the latest F9E March 2018 and description of bios states:

1. Update CPU Microcode

GA-Z270X-Gaming 7 (rev. 1.0) Support | Motherboard - GIGABYTE Australia


Also scanned my system here.

Intel® Driver & Support Assistant​

No supported driver or software updates are available for your system.​

However the "Inspectre" Says "Microcode Update Available YES .. It says I am not protected against Spectre and Meltdown. Why do I have go through this other process with Powershell? Don't you trust what this InSpectre says?

I am confused. That being said my FPS have increased in Battlefield 2042 by 30 fps and I believe it's due to these patches being disabled.

What is the risk ? Why would the Tech Yes City video tell me to disable these if there was a high risk of my computer being accessed illegally?

I just post tutorial i had you can use any method to verify protection from this flaw.

FreeBooter said:

I just post tutorial i had you can use any method to verify protection from this flaw.

Click to expand...

I don't need a tutorial nor need to know how to verify my protection. The InSpectre app does this already. I think you misunderstood me. That's why I posted a screenshot of the app in my OP showing my status with both of these patches.

PvtJohnTowle said:

I am confused. That being said my FPS have increased in Battlefield 2042 by 30 fps and I believe it's due to these patches being disabled.

What is the risk ? Why would the Tech Yes City video tell me to disable these if there was a high risk of my computer being accessed illegally?

Click to expand...

It is one malware family out of millions. It is used with other malware so as long as you are protected, do not worry about it. Actually since it is patched automatically and it is only disabled per user basis, it is no longer exploited as much as before.

PvtJohnTowle said:

I don't need a tutorial nor need to know how to verify my protection. The InSpectre app does this already. I think you misunderstood me. That's why I posted a screenshot of the app in my OP showing my status with both of these patches.

Click to expand...

The sort of video you refer to and numerous forum threads along the same lines are aimed mostly at competetive game players, those who need those few extra frames per second to get a kill in multiplayer games.
For the average computer user or for professional (non gaming) users there is no real need to disable such protections, although you could argue that the chance of being hit by any form of malware using such attack vectors is extremely low.
The question you ask is not answerable by anyone else really.
So the choice is yours, do you use your machine for anything that could cause you severe issues, downtime and/ or monetary loss if your data was compromised, no matter how small the theoretical chance?
Only you really know the value of the data held on your devices, the potential impact to you of any form of attack and the risks you are willing to take.

PvtJohnTowle said:

I don't need a tutorial nor need to know how to verify my protection. The InSpectre app does this already. I think you misunderstood me. That's why I posted a screenshot of the app in my OP showing my status with both of these patches.

Click to expand...

Tutorial there to show you how to patch your system if you don't want to do that i understand.

PvtJohnTowle said:

I was viewing this video and he says to to disable the Spectre and Meltdown with this app , he says having these patches enabled can affect your FPS in games. I have disabled these patches as per screenshot attached to my post.

However, it appears the trade-off is less security and increased vulnerabilty. Is it worth having these disabled and will there be any noticeable increase in my FPS (I haven't tested yet) or is not worth it?

Click to expand...

Whether it's worth it or not is up to you. I wouldn't disable them, but that's me.
You can use a program like Unigine Heaven to see if it affects your fps.

PvtJohnTowle said:

I was viewing this video and he says to to disable the Spectre and Meltdown with this app , he says having these patches enabled can affect your FPS in games. I have disabled these patches as per screenshot attached to my post.

However, it appears the trade-off is less security and increased vulnerabilty. Is it worth having these disabled and will there be any noticeable increase in my FPS (I haven't tested yet) or is not worth it?

Click to expand...

I never trust random videos that tell you to disable security features in pursuit of "more fps".

It is not your pc and data they are risking.

As a minimum, you should backup all critical data, and I strongly recommend image backups as well to offline storage (external usbs).

In the end, if you really want more fps without risking your pc, the best approach is to either buy a separate pc only used for games or buy a more powerful pc.

cereberus said:

I never trust random videos that tell you to disable security features in pursuit of "more fps".

It is not your pc and data they are risking.

As a minimum, you should backup all critical data, and I strongly recommend image backups as well to offline storage (external usbs).

In the end, if you really want more fps without risking your pc, the best approach is to either buy a separate pc only used for games or buy a more powerful pc.

Click to expand...

I have done Benchmark testing to see if there is any benefit in disabling these patches with InSpectre but there isn't . I tested with CineBench and also 3D Mark Time Spy 1.2 , in fact the score on 3D Mark is less with the patches disabled. 8060 vs 8044. CineBench was 6038 disabled then 6177 when enabled. So I have re-enabled both the patches for Spectre and Meltdown and rebooted my computer. It now says both are protected. It does say there is a Microcode update available. However I cannot locate where this is as nothing is on the Gigabyte support website to indicate a newer BIOS than what I already have.. Is this what I should be looking at ?

PvtJohnTowle said:

It does say there is a Microcode update available. However I cannot locate where this is as nothing is on the Gigabyte support website

Click to expand...

The Microcode Update is a Windows patch.


Your 7700K is on both of these lists... but these are Windows 10 patches.




Then there's this...

The problem is, that technically your CPU doesn't support Windows 11.
So I don't think they ever wrote a Windows 11 Microcode patch for the 7700K.

Ghot said:

The Microcode Update is a Windows patch.


Your 7700K is on both of these lists... but these are Windows 10 patches.

KB4494452: Intel microcode updates - Microsoft Support

Describes the latest microcode updates from Intel for Windows 10, version 1709.

support.microsoft.com

KB4465065: Intel microcode updates - Microsoft Support

This article includes Intel microcode updates.

support.microsoft.com

Then there's this...

Windows 10 Help Forums - Search Results

Windows 10 troubleshooting help and support forum, plus thousands of tutorials to help you fix, customize and get the most from Microsoft Windows 10.

www.tenforums.com

The problem is, that technically your CPU doesn't support Windows 11.
So I don't think they ever wrote a Windows 11 Microcode patch for the 7700K.

Click to expand...

How do I know if I have to download it or if it is already installed?

Ghot said:

The Microcode Update is a Windows patch.


Your 7700K is on both of these lists... but these are Windows 10 patches.

KB4494452: Intel microcode updates - Microsoft Support

Describes the latest microcode updates from Intel for Windows 10, version 1709.

support.microsoft.com

KB4465065: Intel microcode updates - Microsoft Support

This article includes Intel microcode updates.

support.microsoft.com

Then there's this...

Windows 10 Help Forums - Search Results

Windows 10 troubleshooting help and support forum, plus thousands of tutorials to help you fix, customize and get the most from Microsoft Windows 10.

www.tenforums.com

The problem is, that technically your CPU doesn't support Windows 11.
So I don't think they ever wrote a Windows 11 Microcode patch for the 7700K.

Click to expand...

I normally download all patches and updates from MS for my computer. I did have Windows 10 installed on the same Mobo and CPU. However I did a clean install for Windows 11. This wouldn't "erase" the Microcode update ? My Mobo does have TPM 1.2 and Secure Boot, so I was able to install Windows 11. I didn't install Windows 11 myself, I got an Airtasker to do it for me, due to the complications of TPM and Secure Boot being needed. I wasn't sure of this and how to find both or how to enable them as they weren't enabled at the time.

The last bios and latest for my Mobo is F9E and I have flashed to this Bios and it states "update CPU Microcode" 2018/03/09

Your 7700K is on both of these lists... but these are Windows 10 patches.

Click to expand...

Are you saying I shouldn't download this as it is Windows 10 ? Why do I need to when InSpectre says I am protected against both ?

PvtJohnTowle said:

How do I know if I have to download it or if it is already installed?

I normally download all patches and updates from MS for my computer. I did have Windows 10 installed on the same Mobo and CPU. However I did a clean install for Windows 11. This wouldn't "erase" the Microcode update ? My Mobo does have TPM 1.2 and Secure Boot, so I was able to install Windows 11. I didn't install Windows 11 myself, I got an Airtasker to do it for me, due to the complications of TPM and Secure Boot being needed. I wasn't sure of this and how to find both or how to enable them as they weren't enabled at the time.

The last bios and latest for my Mobo is F9E and I have flashed to this Bios and it states "update CPU Microcode" 2018/03/09



Are you saying I shouldn't download this as it is Windows 10 ? Why do I need to when InSpectre says I am protected against both ?

Click to expand...

Unlike BIOS updates... these patches are for Windows 10, not Windows 11..
On top of that, because you have a CPU that is incompatible with Windows 11, I have no idea if those patches would work, or if they would break something.

If it was me... I wouldn't use those patches.

This type of Windows Update/Patches are specific to any Major Windows Build (21H2, 22H2, etc) of a specific version of Window (11, 10, 8.1 etc...). They install into that specific version and build of Windows - not like BIOS of Firmware updates - which use the storage of a given device to update the device itself. Same reason you can disable and/or uninstall them just as easily. While a Firmware/BIOS update - is not something you can easily Enable/Disable or remove/uninstall.

My Dell XPS 13 EVO 9305 (22H2) I have checked with the InSpectre and it says that Meltdown is not protected. It has a Tiger Lake Intel® Core™ i5-1135G7 Processor Why wouldn't this be protected as it is a 11th Gen CPU?

PvtJohnTowle said:

I have done Benchmark testing to see if there is any benefit in disabling these patches with InSpectre but there isn't . I tested with CineBench and also 3D Mark Time Spy 1.2 , in fact the score on 3D Mark is less with the patches disabled. 8060 vs 8044. CineBench was 6038 disabled then 6177 when enabled. So I have re-enabled both the patches for Spectre and Meltdown and rebooted my computer. It now says both are protected. It does say there is a Microcode update available. However I cannot locate where this is as nothing is on the Gigabyte support website to indicate a newer BIOS than what I already have.. Is this what I should be looking at ?

Click to expand...

I cannot say but well done for doing your own testing and proving most of these claims are outdated "bollards".