CVE-2022-29900

FAQ

Why is this AMD CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in certain processor models offered by AMD. The mitigation for this vulnerability requires a Windows update. This CVE is being documented in the Security Update Guide to announce that the latest builds of Windows enable the mitigation and provide protection against the vulnerability.

Please see the following for more information:

• AMD-SB-1037

Are any additional steps required to protect my system after installing the July Windows updates?

Customers who allow untrusted users to execute arbitrary code might wish to implement some extra security features within their systems. These features protect against the intra-process disclosure vectors that this speculative execution vulnerability describes. See the following for more information.

• Microsoft Windows client customers: See Microsoft Knowledge Base Article 4073119.
• Microsoft Windows Server/Azure Stack HCI customers: See Microsoft Knowledge Base Article 4072698 for additional information, including workarounds.

Microsoft Azure has taken steps to address the security vulnerabilities at the hypervisor level to protect VMs running in Azure. More information can be found here.

Can I expect any performance impact after I configure the registry keys?

In some cases, installing these updates will have a performance impact. In testing Microsoft has seen some performance impact with these mitigations, in particular when hyperthreading is disabled. Microsoft values the security of its software and services and has made the decision to implement certain mitigation strategies in an effort to better secure our products. In some cases, mitigations are not enabled by default to allow users and administrators to evaluate the performance impact and risk exposure before deciding to enable the mitigations. We continue to work with hardware vendors to improve performance while maintaining a high level of security.

The Security Updates table indicates that all versions of Windows are affected. When will updates be available for my operating system?

Currently we have released updates for Windows Server 2022 and Windows Server 2022 (Server Core installation). Addressing a hardware vulnerability with a software update presents significant challenges with some operating systems requiring extensive architectural changes. Microsoft continues to work with AMD to investigate and prioritize the best way to provide mitigations and will release further updates as needed to help protect customers. The Security Updates table will be updated as updates are released. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this CVE. See Microsoft Technical Security Notifications and Coming Soon: New Security Update Guide Notification System.

Are Microsoft Azure assets protected?

Microsoft has already deployed mitigations across our cloud services. More information is available here.

How do I know if I am affected?

Please refer to AMD advisory AMD-SB-1037 to determine which AMD CPUs are affected.