Hackers can bypass Windows Meltdown patch in Windows 10

[straycat19]

A newly discovered flaw in the Windows 10 patches against Spectre and Meltdown renders them completely useless through the use of the NtCallEnclave command, which returns the full kernel page table directory.

 

•Microsoft fixed the flaw in the Windows 10 April 2018 Update but hasn't backported the patch to older Windows 10 systems yet. The exploit only applies to Windows 10 systems. 

 

The patches that Microsoft issued to fix Spectre and Meltdown could be completely nullified by by calling a particular command, one analyst has found. 

 

Security researcher Alex Ionescu of Crowdstrike said in a tweet that the flaw completely undermines the mitigation, rendering it useless. "Calling NtCallEnclave returned back to user space with the full kernel page table directory," Ionescu said. 

 

Those who have installed the Windows 10 April 2018 Update are safe—the update fixes the problem. It's also unique to Windows 10, so those on older versions of Windows don't need to worry. If you're running Windows 10 and haven't installed the April 2018 Update you should get on that right away: Microsoft hasn't released a backport yet. 

 

A useless fix

 

Spectre and Meltdown are a pair of vulnerabilities that affect nearly every single processor in the world. The two exploits allow an attacker to bypass most kinds of system security in order to read sensitive data stored in the computer's kernel memory. 

 

The patches issued by Microsoft should have stopped that information from being accessible from the user side of a Windows system, but in this case they didn't. All an attacker needs to do is find a way to run the NtCallEnclave command and they get instant access to the kernel page table directory, which contains all the sensitive information the patch should have protected. 

 

A Microsoft spokesperson told Bleeping Computer that it is planning backported patches for earlier versions of Windows 10, but the source didn't state when those would be available. 

 

If you have a Windows 10 machine that is eligible for the April 2018 Update you should install it as soon as possible, and IT teams who are testing the update for full-scale rollout should accelerate their timetables to get the patch into users' hands ASAP. 

If you have a Windows 10 computer that isn't eligible for the update be sure to keep your security software current to protect you from any malware that may try to take advantage of this newly revealed flaw. 

Ionescu didn't state how exploitable the NtCallEnclave flaw is, but there's no reason to find out the hard way: Update today. 
 

Source

[steven36]

I already posted this info Thursday 

 

 

I guess a fix for it  will be out today , which it really don't effect me because it only effected Windows 10 and I use Windows 8.1 and Linux .

[digimon]

not suprise i have a feeling meltdown and spectre are here to stay in some way shape or form until the processor is redesigned

 

there are other exploits that take advantage of the spectre attack vector anyway

 

https://www.scmagazineuk.com/ghosts-in-the-machine-researchers-find-8-more-spectre-flaws-in-cpu-chips/article/764245/

 

there will probably be hundreads of more before all is said and done (i see this basicly being the same thing as ie6 was cept its hardware and not software how many patches did microsoft release for it? was it ever secure? no it wasnt the same thing with modern cpu hardware patch all you want its not going to fix the problem without completly redesigning the processor)

[Reefa]

 Already posted .

Thread closed...