UEFI BIOS Updates For Spectre

R

rgMekanic

[H]ard|News
Joined
May 13, 2013
Messages
6,943
With the Spectre vulnerability exposed, Intel is rushing out new microcode, and motherboard manufacturers are working hard to get BIOS updates released. The news today about InSpectre got us thinking, have there been any BIOS updates for our machines, and will there be? It looks like X99 is as far back as Intel is willing to go with microcode updates.

ASUS has a page you can find here to see if your motherboard has an updated BIOS. Unfortunately only 2 X99 boards appear like they will be getting any love.

GIGABYTE has a similar page here, unfortunately it does not look like they are going back to X99 at this time, but Gigabyte did tell us several X99 boards are in testing now, and the page will be updated when it becomes available for download.

MSI's page is available here. So far they have only released updates for Z370, but there is a list of motherboards that will be getting the update.

ASRock doesn't have a dedicated page that we could find, but its support site shows many new BIOS updates have been released in the last week, with presumably more coming soon. (Update: UEFI/BIOS patch microsite for AsRock.)
 
Last edited by a moderator:
I'm curious about why the microcode updates are going on. I initially heard that the changes that were needed were at a code level, rather than the CPU level. Is this doing more than the software patches from Microsoft and Linux? Are they absolutely needed if the software fixes are in place?
 
dgingeri said:
I'm curious about why the microcode updates are going on. I initially heard that the changes that were needed were at a code level, rather than the CPU level. Is this doing more than the software patches from Microsoft and Linux? Are they absolutely needed if the software fixes are in place?
Click to expand...

Software fixes work for Meltdown, Spectre requires microcode updates
 
gigabyte currently going back to z170/b150... not holding my breath on z77 any time soon but i'll risk it I guess
 
Awesome, I dont know how you guys find these links but I am plenty thrilled you do. Will share post as to bring you more readers! My Asus x99 - A II wasnt listed yet but I'll keep checking. Thx for helping your readers out. :)
 
didn't see Z77 ivy bridge on asus with any bios update... does that mean ivy bridge users have to upgrade o-O: ?
 
dburgo said:
Awesome, I dont know how you guys find these links but I am plenty thrilled you do. Will share post as to bring you more readers! My Asus x99 - A II wasnt listed yet but I'll keep checking. Thx for helping your readers out. :)
Click to expand...

No problem, they were a bit hidden on a lot of the manufacturers sites for some reason, but this is info every enthusiast needs, so thank you for sharing it.

Moogle Stiltzkin said:
didn't see Z77 ivy bridge on asus with any bios update... does that mean ivy bridge users have to upgrade o-O: ?
Click to expand...

Seems like it, IMO Intel should have to pay every motherboard manufacturer for their time to release BIOS' for every effected system, but it looks like X99 is where they're stopping :/
 
Wow only back to X99 ? I love bang for buck systems and there is a lot left in the tank on older platforms than that!

I went back to AMD with my personal system because Ryzen turned out to be very good IMO. With this news maybe I’ll sell off the kids intel boards and cpus and go AMD in the whole house. Screw the blue team for this shite. I’m not overly concerned about getting compromised so much as turned off by the way it’s being handled.
 
wow only 2 boards from asus.and ones most people wont buy.guess my x99-E won't have to worry about slowing my 5930 down.:)
 
jesus christ... so they are not going to patch sandy / ivy / hasswell .. man screw intel

k' now I'm super pissed... I'm almost certain my upgrade later this year is ryzen+

I would encourage intel to reconsider being giant c*cks about this and move that patch plan back at least to sandy bridge.. otherwise maybe I can sue them in small claims court for the 4x systems in my house that are basically junk now?? anyone tried suing intel in small claims court for damages yet?
 
atarione said:
jesus christ... so they are not going to patch sandy / ivy / hasswell .. man screw intel

k' now I'm super pissed... I'm almost certain my upgrade later this year is ryzen+

I would encourage intel to reconsider being giant c*cks about this and move that patch plan back at least to sandy bridge.. otherwise maybe I can sue them in small claims court for the 4x systems in my house that are basically junk now?? anyone tried suing intel in small claims court for damages yet?
Click to expand...

They aren't junk. You just have to be more careful to avoid malware. If the system isn't compromised in other ways, neither of these can be used to gain anything. They can't be used as an entrance to the system, only to gain extra information once the system is compromised. So, for example, my file server, based on a Core i5 2500k, is just fine. It won't get compromised because nobody is going to be surfing the internet on it, so I don't have to worry about Spectre on it at all.
 
TheHig said:
Wow only back to X99 ? I love bang for buck systems and there is a lot left in the tank on older platforms than that!

I went back to AMD with my personal system because Ryzen turned out to be very good IMO. With this news maybe I’ll sell off the kids intel boards and cpus and go AMD in the whole house. Screw the blue team for this shite. I’m not overly concerned about getting compromised so much as turned off by the way it’s being handled.
Click to expand...

atarione said:
jesus christ... so they are not going to patch sandy / ivy / hasswell .. man screw intel

k' now I'm super pissed... I'm almost certain my upgrade later this year is ryzen+

I would encourage intel to reconsider being giant c*cks about this and move that patch plan back at least to sandy bridge.. otherwise maybe I can sue them in small claims court for the 4x systems in my house that are basically junk now?? anyone tried suing intel in small claims court for damages yet?
Click to expand...

I 100% agree with both of you. My HTPC is an i7 870 and my wifes machine is an i5 3470, her laptop is Ivy something, my laptop is Sandy something. And my main rig is literally the last one on MSI's list, so I either just made it or I'll be the first one to get the "ah screw it"

Any new builds coming in here will be AMD, I'm sick of them dropping support on still viable hardware, that 4k Netflix hardware lock, etc.
 
Asus has updated Bios for the X299 family. Some have been up for a couple of days. Some are just posted today.
 
Nice. My laptop will definitely not be getting an update. It spends all it's "on" time on public hotel networks.
Guess I need to remove all personal info from it, or is this basically a second line of defense?
 
I see a bios update for my Gigabyte X87 board but it's for MATS tables and OS compatibility, first bios update in 3 years and it's a beta, hmm
Maybe they will release a F10 soon that is not a beta.
 
Intel just cut off their nose in spite of their face.

AMD from now on. Man o man am I pissed off. Pay a premium for a mobo and this is how they repay you.
 
Man, with the naming schemes they have these days, thank goodness cpu-id shows me the model of my board, too many that are just one letter difference. Strix z270f gaming btw. Has an update, but it slows the computer like the other software patch does wouldn't it? I don't think I'll update it, currently has a 1009 bios on it from mid last year.
 
As someone with 4+ Z87 and Z97's - all on Windows 7 with plenty of life left in them - it looks like EVGA might do us a solid:
https://forums.evga.com/Attention-E...-for-your-BIOS-security-patches-m2747985.aspx

Reply posted by EVGA
thumbup1.gif
https://forums.evga.com/FindPost/2749683 (scroll down to where an EVGATech_LeeM responds)

This is our current schedule for BIOS updates related to these vulnerabilities:
By end of this week*: Z170, Z270, Z370, X99, X299, Laptops.
Within 1-2 weeks*: X79, W888, Z87, Z97.​

*Please note that this date is projected, contingent on receiving source code from Intel, and final testing may push the dates back temporarily.

At this point, we do not have source code from Intel to update X58, P67, or Z77 motherboards. When/if that becomes available, I'll provide an update.
Click to expand...
 
Last edited:
I read somewhere that Intel pulled back on Broadwell E as it had issues. The only issue I have is Dual Intelligent processor 5 isn't working. Luckily I'm on a new rebuild so any malware so to speak of hasn't seethed its way into my rig. I think it's crummy if they dont provide Broadwell support. I paid $230+ for my Asus X99 A-II not even over year ago! Too many black hats in the world these days, it really looks bad for the white hats having to deal with so many hacks going on daily. They really started 2018 with oozy death. :/
 
dgingeri said:
They aren't junk. You just have to be more careful to avoid malware. If the system isn't compromised in other ways, neither of these can be used to gain anything. They can't be used as an entrance to the system, only to gain extra information once the system is compromised. So, for example, my file server, based on a Core i5 2500k, is just fine. It won't get compromised because nobody is going to be surfing the internet on it, so I don't have to worry about Spectre on it at all.
Click to expand...


well 3x of the systems are basically junk because people are getting on the internet with them.. If I can't get a patch for spectre then they are basically useless to me for what I needed them for..

I'm going to ditch my HTPC (don't use it much anyways.. have chromecast and roku) and upgrade my wife's and my own pc's to AMD based setups... 90~% sure that is what i'm going to do .. if i can't get patches for her sandybridge rig and my Hasswell one..

and I'm going to be mad (read as not buying intel) at intel for a LOOOOOOOOOONG TIME about it.
 
I already see bioses for at least some models of Thinkstation S30 (sandy bridge capable...) -- 6 year old+ machines getting bios updates...!

This is why I lean more towards buying pre-builts off of Ebay these days.

My wifes self built Q8200 has been replaced by an Ivy bridge Optiplex 7010. Bios update? Yep! Price? $94 shipped on Ebay.

Meanwhile, I"m guessing my Gigabyte/MSI/ASRock Haswell self-built machines won't see anything.

Edit: Bios Status:
Nothing since 2014 for my MSI (Z87-G41 PC Mate)
Nothing since 2016 for my ASrock Z97 Extreme6 (Extremely unsupported apparently)
Nothing since 2016 for my Gigabyte Z87-UD3H

SoL
 
Last edited:
Moogle Stiltzkin said:
didn't see Z77 ivy bridge on asus with any bios update... does that mean ivy bridge users have to upgrade o-O: ?
Click to expand...

Gigabyte Z77 system here. Wonder if some of the lawsuits will prompt Intel to go farther back then their current plans? Maybe Intel should have to file an environmental impact statement on the excess e-waste generated by not patching farther back.
 
Looks like Asrock has updates for all their latest boards going back to Z170, but nothing older.

I've submitted a support request asking about older boards. We shall see. No reason they shouldn't update at least back to Haswell.
 
Asus does not seem to have a BIOS update available yet for my z170i Pro Gaming board. I'll check daily from this point on.
 
I am sure there will be plenty of people on this forum as well who simply don't want the update - given the fact that there is a performance hit and likelihood of the exploit being, um, exploited.

Thsi has the added effect also that for those who do not want the update, they can only update to BIOS version XX before the microcode is included... so any future updates they may want are out of reach :/
 
Wait, if updated specifically asrock, will any performance be decreased and if so can UEFI be reverted?

My z75 pro3 isn't listed yet.
http://www.asrock.com/support/index.asp?cat=BIOS

So before you guys do update, make sure you can revert back as IBM did this BIOS lock to reverting the BIOS to older version and pulled all old BIOS's prior of the latest removing AHCI option from one of their boards I owned.

Lesson learned and just passing this along to one who cares. Don't jump the gun like I did without reading.
 
Gigabyte had a bios for my board right away, and it's an odd ball z170-mx matx board. Also had a firmware update for the issue as well. Not sure what that did?
 
rgMekanic said:
Software fixes work for Meltdown, Spectre requires microcode updates
Click to expand...

Specifically,

"Microsoft says firmware updates are only required to protect against what’s being described as Spectre variant 2."

"AMD said the second Spectre variant 'is applicable to AMD' processors and that it would issue patches for its Ryzen and EPYC processors starting this week and older chips in the coming weeks."
 
Last edited:
  • Like
Reactions: Nobu
like this
LOL at everyone thinking their z97/77 boards are going to get an update and the motherboard manufacturers aren't going to use this as an excuse to cash in on people buying new boards.
 
Gweenz said:
LOL at everyone thinking their z97/77 boards are going to get an update and the motherboard manufacturers aren't going to use this as an excuse to cash in on people buying new boards.
Click to expand...

Well, like I said my wife's $94 (used) optiplex 7010 (I can't imagine that was even $1k new for the whole machine) has an update....That is ivy based...
 
I cannot see Intel not releasing microcode for as far back as sandy bridge.. there are plenty of servers out there with Xeon's that old that are still in production use by many companies. If they don't they will really be shooting themselves in the foot.

Let's give them a few weeks to get them out. The downside is that we are also at the mercy of the mobo manufacturer putting out the updates. ASUS damn well better put out a bios for my x58 and the P8BWS that runs my ESXi...

Some bit of good news, if you run ESXi or vmware workstation, those already have some microcode updates that load even when the actual bios isn't patched, that is used in the virtual machine. I think this was one of the main ways these exploits were afraid of being used... The Cloud providers likely have notices out stating their patch levels and how they've addressed this. (This is all virtual and usually the backend equipment can be shared by multiple customers. This was a primary way data could have been stolen).
 
Last edited:
You must log in or register to reply here.
Back
Top