2

I've run AWS Inspector on a Windows Server 2012 R2 server and it detected some vulnerabilities. For example, this one CVE-2019-11091, which is fixed in KB4499158.

However, this are the update I have installed:

installed updates

That means that all updates are installed (except 3 that came in the last week).

Is that issue supposed to be fixed or not? I'm trying to understand if I need to fix it another way, it hasn't been fixed yet or AWS inspector is not working well. Thanks!

UPDATE:

Greg's suggested script output:

Speculation control settings for CVE-2017-5715 [branch target injection]

Hardware support for branch target injection mitigation is present: False

Windows OS support for branch target injection mitigation is present: True

Windows OS support for branch target injection mitigation is enabled: False

Windows OS support for branch target injection mitigation is disabled by system policy: True

Windows OS support for branch target injection mitigation is disabled by absence of hardware support: True

Speculation control settings for CVE-2017-5754 [rogue data cache load]

Hardware requires kernel VA shadowing: True

Windows OS support for kernel VA shadow is present: True

Windows OS support for kernel VA shadow is enabled: False

Speculation control settings for CVE-2018-3639 [speculative store bypass]

Hardware is vulnerable to speculative store bypass: True

Hardware support for speculative store bypass disable is present: False

Windows OS support for speculative store bypass disable is present: True

Windows OS support for speculative store bypass disable is enabled system-wide: False

Speculation control settings for CVE-2018-3620 [L1 terminal fault]

Hardware is vulnerable to L1 terminal fault: True

Windows OS support for L1 terminal fault mitigation is present: True

Windows OS support for L1 terminal fault mitigation is enabled: False

Speculation control settings for MDS [microarchitectural data sampling]

Windows OS support for MDS mitigation is present: True

Hardware is vulnerable to MDS: True

Windows OS support for MDS mitigation is enabled: False

Suggested actions

  • Install BIOS/firmware update provided by your device OEM that enables hardware support for the branch target injection mitigation.

  • Follow the guidance for enabling Windows Server support for speculation control mitigations described in https://support.microsoft.com/help/4072698

BTIHardwarePresent : False

BTIWindowsSupportPresent : True

BTIWindowsSupportEnabled : False

BTIDisabledBySystemPolicy : True

BTIDisabledByNoHardwareSupport : True

BTIKernelRetpolineEnabled : False

BTIKernelImportOptimizationEnabled : False

KVAShadowRequired : True

KVAShadowWindowsSupportPresent : True

KVAShadowWindowsSupportEnabled : False

KVAShadowPcidEnabled : False

SSBDWindowsSupportPresent : True

SSBDHardwareVulnerable : True

SSBDHardwarePresent : False

SSBDWindowsSupportEnabledSystemWide : False

L1TFHardwareVulnerable : True

L1TFWindowsSupportPresent : True

L1TFWindowsSupportEnabled : False

L1TFInvalidPteBit : 45

L1DFlushSupported : False

MDSWindowsSupportPresent : True

MDSHardwareVulnerable : True

MDSWindowsSupportEnabled : False

Improve this question

1 Answer 1

Reset to default
2

It could mean the registry values do not exist to enable the mitigation.

You can get more information by running the Microsoft Speculation Control script.

https://support.microsoft.com/en-us/help/4074629/understanding-the-output-of-get-speculationcontrolsettings-powershell

https://support.microsoft.com/en-us/help/4072698/windows-server-speculative-execution-side-channel-vulnerabilities-prot

The registry values will differ if Hyper-threading is enabled or disabled:

Enabled:

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 72 /f

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f

Disabled: 

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 8264 /f

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f

A restart is required to go into effect.

Improve this answer
11
  • Thank you! I'll try that when I can restart the server. The only setting I have in the registry is FeatureSettings=3. Do you know if there are any known issues if I enable those options?
    – Diego Jancic
    Dec 16, 2019 at 20:12
  • Two of the four vulnerability classes require firmware/microcode updates. Enabling the MDS settings implies enabling the settings for the other classes. The settings should not be enabled unless the firmware/microcode has been updated. This should be reported in the script output.
    – Greg Askew
    Dec 16, 2019 at 20:56
  • Added output. If I'm understanding it correctly, it's supported but not enabled. Any suggestions?
    – Diego Jancic
    Dec 16, 2019 at 21:42
  • BTIDisabledByNoHardwareSupport : True. That's not a good sign. My guess is it is an old AMI (not sure what you are running). I wouldn't enable the setting, but maybe someone else that has done this can provide more information.
    – Greg Askew
    Dec 16, 2019 at 21:49
  • OK. Thank you! I guess I'll leave it like that then until I can update. Yes, the AMI is pretty old.
    – Diego Jancic
    Dec 16, 2019 at 22:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .