KB4100480 Windows kernel update for CVE-2018-1038 for Windows 7

Hijin25 · 31 Mar 2018

Installing KB4099950 makes KB4088875 appear again in windows update?

Brds7t7 · 31 Mar 2018

Hijin25 said:

Installing KB4099950 makes KB4088875 appear again in windows update?

Not for me, but the March Rollup has never appeared in my list. And since some articles were stating it was pulled, I can only assume it wasn't reissued.

But, still no sign of update KB4100480. I'm thinking it's only offered to Rollup users. Waiting to hear from some Security-only update users to see if it's turned up in their lists? If it does then something is wrong with all my systems!

Hijin25 · 31 Mar 2018

Brds7t7 said:

Not for me, but the March Rollup has never appeared in my list. And since some articles were stating it was pulled, I can only assume it wasn't reissued.

But, still no sign of update KB4100480. I'm thinking it's only offered to Rollup users. Waiting to hear from some Security-only update users to see if it's turned up in their lists? If it does then something is wrong with all my systems!

To me if I appeared KB4100480, and never install or appeared to install the Rollup March.

hake · 31 Mar 2018

I thought that the Microsoft updates were automatically negotiated by Windows Update with the update server and so installed in the correct order and therefore needed no user intervention. Some of the comments here suggest otherwise, especially that from Brds7t7. The most recent update presented to me was KB4099950, all 29kb of it. I had previously installed all the 2018 January, February and March updates offered to me.

KB4099950 was an optional/recommended update. My Windows Update is configured so that recommended updates are presented as optional.

lehnerus2000 · 31 Mar 2018

If MS aren't a bunch of jerks, this month's update should replace the last 3 month's worth of garbage updates with a single working update.

wutangdoge · 31 Mar 2018

The update appeared after checking for new updates and is working fine without the buggy march updates (KB4088875 & KB4088878).

Brds7t7 · 01 Apr 2018

hake said:

I thought that the Microsoft updates were automatically negotiated by Windows Update with the update server and so installed in the correct order and therefore needed no user intervention.

That was what I always thought, but according to the KB article that update should be installed prior to the March Security-only update/Rollup, so that's what I did. I think that update is just to apply the VBS script that was added to the March update articles.

lehnerus2000 said:

If MS aren't a bunch of jerks, this month's update should replace the last 3 month's worth of garbage updates with a single working update.

The whole thing has been a bork up since January!

Anyway, still no sign of this update appearing for me, but I've read that even some users syncing up to WSUS servers aren't having this update appear, so not sure if MS has borked up the detection or there are some different prerequisites as to when this update does/doesn't appear.

hake · 01 Apr 2018

I have found these comments on the issue which might be of interest to those reading this thread:-
http://blog.frizk.net/2018/03/total-meltdown.html

hake · 02 Apr 2018

I installed KB4100480 Windows kernel update for CVE-2018-1038 for Windows 7 (64bit) on a system with an AMD Sempron 3000+ 64bit processor. The system was very slow afterwards. I removed the update by doing a system restore and performance reverted to the previous acceptable level. The AMD Sempron 3000+ processor is apparently not susceptible to Meltdown and Steve Gibson's Inspectre tool confirms this.

I also installed KB4100480 on an Intel Pentium 4 Prescott 3.2GHz twin core 64bit processor powered Windows 7 system. No change in performance has been noted and it runs fine. This suggests to me that previous MS updates since Jan 2018 might have behaved differently with old AMD processors than with Intel processors. After my AMD Sempron 3000+ powered Windows 7 system was bricked in January, I noticed that the January rollup had become unavailable for it after I had recovered it from a backup taken in November 2017.

Is there a simple-to-use tool to test a system for the Microsoft contrived vulnerability? What a mess. Windows 7 is a consumer product and customers rightly expect Windows updates not to require expert management.

I have seen that this privilege escalation issue is mentioned in connection with PCs used in business environments. Also, to be an exploitable vulnerability the system must be accessible to be logged onto. Since inexpertly managed Windows 7 systems are more likely to be home used systems, physical access by an exploiter will be much less likely. I am not sure if remote logons represent a hazard in this context.

TechnoMage2016 · 02 Apr 2018

I have used and loved AMD processors for years, ever since the old 386 days. But... The Sempron 3000 was always at the bottom of the stack and a poor performer.
It could only do just so much, so fast, and push it too hard and it could let you down.

I just sent my last Sempron 3000 to reclamation about a month ago. So my only real solution to your problem would be to upgrade your CPU.

Cheers Mate!