Windows 7 Meltdown patch opens worse vulnerability: Install March updates now
Summary
Microsofts early patches for Intels Meltdown CPU vulnerability created an even bigger problem in Windows 7 that allowed any unprivileged application to read kernel memory.Microsofts January and February patches stopped the Meltdown bug that exposed passwords in protected memory, but security researcher Ulf Frisk has discovered that the patches introduced a far worse kernel bug, which allows any process to read and write anywhere in kernel memory.According to Frisk, the two faulty patches wrongly set a bit in the virtual-to-physical-memory translator known as PLM4 to allow any user-mode application to access the kernels page tables.Chips that sparked Intels recall of microcode for Spectre Variant 2 attack now have stable fixes.The out-of-band update disabled Intels mitigation for the Spectre Variant 2 attack, which Microsoft says can cause data loss on top of unexpected reboots.