Intel has finally released new microcode updates to address the Spectre Variant 2 flaw in the older chips that triggered its across-the-board halt on early fixes for the vulnerability.

Following last week's release of reworked microcode updates for Skylake, Kaby Lake, and Coffee Lake chips, Intel has released corresponding updates for its older Broadwell and Haswell chips.

The updates address Variant 2 of the three Meltdown and Spectre CPU flaws that Google revealed on January 3 and are released to end-users as firmware or BIOS updates from hardware manufacturers.

Within days of Intel releasing its hardware fixes for the branch target injection flaw, Intel confirmed customer reports that it was causing higher reboots on Broadwell and Haswell processors.

By January 22 it urged hardware makers and customers to stop deploying its first microcode updates for all chip families affected by the flaws.

Intel developed stable beta fixes for Broadwell and Haswell chips first but released "production"-ready fixes for its 6th generation Skylake-based platforms ahead of others. As of last week's update, it had rereleased production fixes for its 6th, 7th, and 8th generation Intel Core chips and its latest Core X processors.

Chips with production fixes in Intel's microcode update guidance document have been validated by Intel and approved for use in a production environment.

New production-ready updates are available for all Broadwell and Haswell chip families except Broadwell Server EX and Haswell Server EX, which remain in beta.

The stable updates are available for Xeon and Intel Core i chips, including Broadwell H 43e-series Core i chips and Broadwell U- and Y-series Core i processors.

New updates for Intel's Sandy Bridge and Ivy Bridge families of processors remains in beta, which means the company has released microcode updates for customers to validate under a non-disclosure agreement. Similarly, while most Skylake chips are in production, Skylake Xeon E3 remains in beta.

Intel this week also explained why it didn't tell the Department of Homeland Security's US CERT/CC (Computer Emergency Readiness Team Coordination Center) before Google publicly disclosed Meltdown and Spectre, following a report from The Register.

In a response to questions from the US House of Representatives Committee on Energy and Commerce, Intel said it intended to brief the government before the planned public disclosure on January 9, but that was derailed by the flaws being leaked to the public.

"The US Computer Emergency Readiness Team was first informed of the exploits through public disclosure on January 3, 2018. Intel promptly discussed this disclosure with US-CERT on that day and again two days later, on January 5, 2018," it said.

Intel said its embargo, which limited knowledge of the flaws to Google, Apple, Microsoft, and Arm, was in line with industry standards for vulnerability disclosure and incident response.

By: DocMemory
Copyright © 2023 CST, Inc. All Rights Reserved