[Request] Spectre/Meltdown Patches For Windows XP SP3

[legacyfan]

has anyone seen this update? I'm working on collecting updates for xp and these 2 are the few updates that are harder to find ive searched the catalog plus several more places and can't seem to find them anywhere if anyone could help me find this or knows where to download this it would br much appreciated

Edited March 31, 2023 by legacyfan

[George King]

Use WU Dump if needed. Btw, what KBs are you searching for?

I have almost all XP Updates for all languages except one request only, which was never found on internet.

[legacyfan]

16 minutes ago, George King said:

Use WU Dump if needed. Btw, what KBs are you searching for?

I have almost all XP Updates for all languages except one request only, which was never found on internet.

I'm looking for the unofficial spectre/meltdown Patches for posready2009 (its the only way to install the patch on xp)

Edited March 31, 2023 by legacyfan

[Country Cat]

I think I saw a user named "mockingbird" on another forum asked about a Spectre/Meltdown patch for POSReady2009 back in 2018, but I don't know if they ever found one. I'm sorry; I wish I could be of more help. Good luck on your search, and I'll be sure to let you know if I manage to find more info.

Edit: Question was updated to be more general, KB4056615 seems to be the one you are searching for.

Edited April 2, 2023 by Country Cat
Question was updated

[AstroSkipper]

19 hours ago, legacyfan said:

has anyone seen this update? I'm working on collecting updates for xp and these 2 are the few updates that are harder to find ive searched the catalog plus several more places and can't seem to find them anywhere if anyone could help me find this or knows where to download this it would br much appreciated

You did not provide any detailed information what you are looking for. What about KB numbers? I assume you are looking for these two updates: KB4056615 and KB4056941. Use the Windows Update Catalog! I found them, but the German language versions, though. Logically! I am located in Germany. You will be offered the English ones in your country. 

Edited April 1, 2023 by AstroSkipper
Update of content

[George King]

I will check these updated tomorrow. I think there are newer ones.

[Vistapocalypse]

MSFN members installing POSReady 2009 updates on Windows XP five years ago often reported issues with KB4056615. Visit this link and read a dozen or more pages if you’re curious:

https://msfn.org/board/topic/171814-posready-2009-updates-ported-to-windows-xp-sp3-enu/page/131/

[legacyfan]

thankyou everyone for the help i will look into these websites and see what information I can find on it 

[legacyfan]

thank you to everyone that gave me download links it much appreciated

Edited April 2, 2023 by legacyfan

[AstroSkipper]

6 minutes ago, legacyfan said:

thanks @AstroSkipper for the information and the download links

You're welcome! As @Vistapocalypse already said, this matter was already discussed in the thread "POSReady 2009 updates ported to Windows XP SP3 ENU". All Spectre and Meltdown vulnerabilities depend massively on the CPU architecture of the computer that is to be protected. I would recommend reading the comments there and getting more information on the internet. 

[George King]

On 4/1/2023 at 1:32 PM, AstroSkipper said:

You did not provide any detailed information what you are looking for. What about KB numbers? I assume you are looking for these two updates: KB4056615 and KB4056941. Use the Windows Update Catalog! I found them, but the German language versions, though. Logically! I am located in Germany. You will be offered the English ones in your country. 

@legacyfan KB4056615 is replaced by KB4463103 

[legacyfan]

20 minutes ago, George King said:

@legacyfan KB4056615 is replaced by KB4463103 

okay thanks!

[Zorba the Geek]

On 4/1/2023 at 7:24 PM, AstroSkipper said:

All Spectre and Meltdown vulnerabilities depend massively on the CPU architecture of the computer that is to be protected.

I did some research and discovered that there have been no Spectre and Meltdown kernel patches released for Core2Duo CPUs, so I was out of luck.  As for the the POSReady 2009 updates mentioned here I am not convinced that they are intended to resolve the Spectre and Meltdown vulnerabilities.

KB4056615 is covered by CVE-2018-0748 whose summary is as follows:

Quote

An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions. An attacker who successfully exploited the vulnerability could impersonate processes, interject cross-process communication, or interrupt system functionality.

To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.

The security update addresses the vulnerability by helping to ensure that the Windows Kernel API properly enforces permissions.

KB4056615 has been replaced by KB4463103 which is covered by CVE-2018-8411 whose summary is as follows:

Quote

An elevation of privilege vulnerability exists when NTFS improperly checks access. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

To exploit the vulnerability, an attacker would first have to log on to the system, and then run a specially crafted application to take control over the affected system.

The security update addresses the vulnerability by correcting how NTFS checks access.

and is also covered by CVE-2018-8330 whose summary is as follows:

Quote

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.

To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.

The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.

I have KB4463103 included as an update on my system and tests for Spectre and Meltdown mitigation showed that there was nothing.  I am completely unprotected.

Edited April 30, 2023 by Zorba the Geek

[AstroSkipper]

2 hours ago, Zorba the Geek said:

I did some research and discovered that there have been no Spectre and Meltdown kernel patches released for Core2Duo CPUs, so I was out of luck.  As for the the POSReady 2009 updates mentioned here I am not convinced that they are intended to resolve the Spectre and Meltdown vulnerabilities.

KB4056615 is covered by CVE-2018-0748 whose summary is as follows:

KB4056615 has been replaced by KB4463103 which is covered by CVE-2018-8411 whose summary is as follows:

and is also covered by CVE-2018-8330 whose summary is as follows:

I have KB4463103 included as an update on my system and tests for Spectre and Meltdown mitigation showed that there was nothing.  I am completely unprotected.

Well, unfortunately, you can't always be lucky. In any case, a well-researched, detailed investigation of the Spectre and Meltdown vulnerabilities.