June 12, 2018—KB4284860 (OS Build 10240.17889)

2018-06-15T22:25:29
ID KB4284860
Type mskb
Reporter Microsoft
Modified 2018-06-15T22:26:23

Description

<html><body><p>Learn more about update KB4284860, including improvements and fixes, any known issues, and how to get the update.</p><h2>Improvements and fixes</h2><div><p>This update includes quality improvements. No new operating system features are being introduced in this update. Key changes include:</p><ul><li>Provides support to control usage of Indirect Branch Prediction Barrier (IBPB) on some AMD processors (CPUs) for mitigating CVE-2017-5715, Spectre Variant 2 when switching from user context to kernel context. (See <a href="https://developer.amd.com/wp-content/resources/Architecture_Guidelines_Update_Indirect_Branch_Control.pdf" managed-link="" target="_blank">AMD Architecture Guidelines for Indirect Branch Control</a> and <a href="https://www.amd.com/en/corporate/security-updates">AMD Security Updates</a> for more details). For Windows client (IT pro) guidance, follow the instructions in <a data-content-id="4073119" data-content-type="article" href="" managed-link="" target="_blank">KB4073119</a>. Use this guidance document to enable IBPB on some AMD processors (CPUs) for mitigating Spectre Variant 2 when switching from user context to kernel context.</li><li>Provides protections from an additional subclass of speculative execution side channel vulnerability known as <em><a href="https://blogs.technet.microsoft.com/srd/2018/05/21/analysis-and-mitigation-of-speculative-store-bypass-cve-2018-3639/"><em>Speculative Store Bypass</em></a></em> (CVE-2018-3639). These protections aren't enabled by default. For Windows client (IT pro) guidance, follow the instructions in <a data-content-id="4073119" data-content-type="article" href="" managed-link="" target="_blank">KB4073119</a>. Use this guidance document to enable mitigations for Speculative Store Bypass (CVE-2018-3639) in addition to the mitigations that have already been released for Spectre Variant 2 (CVE-2017-5715) and Meltdown (CVE-2017-5754).</li><li>Addresses an issue that sometimes prevents eDrives from unlocking when an eDrive is a secondary drive and the system drive is protected with BitLocker. </li><li><p><span><span><span><span><span>Addresses an issue where firmware updates cause devices to go into BitLocker recovery mode when BitLocker is enabled but Secure Boot isn't present or disabled. </span></span></span></span></span> This update prevents firmware installation on devices in this state. Administrators can install firmware updates by:</p><ol><li>Temporarily suspending BitLocker.</li><li>Immediately installing firmware updates before the next OS startup.</li><li>Immediately restarting the device so that BitLocker doesn’t remain in the suspended state.</li></ol></li><li>Addresses an issue where booting with Unified Write Filter (UWF) enabled may lead to stop error 0xE1 on embedded devices, particularly when using a USB hub. </li><li>Increased the Internet Explorer cookie limit from 50 to better align with industry standards</li><li>Security updates to Internet Explorer, Microsoft Edge, Microsoft scripting engine, Windows apps, Windows Server, Windows wireless networking, Windows storage and filesystem, remote code execution, and Windows virtualization and kernel.</li></ul><p>If you installed earlier updates, only the new fixes in this package will be downloaded and installed on your device.</p><p>For more information about the resolved security vulnerabilities, see the <a href="https://portal.msrc.microsoft.com/security-guidance">Security Update Guide</a>.</p><div class="alert-band"><div class="alert alert-info" role="alert"><p class="alert-title">Windows Update Improvements</p><div class="row"><div class="col-xs-24"><p>Microsoft has released an update directly to the Windows Update client to improve reliability. Any device running Windows 10 configured to receive updates automatically from Windows Update, including Enterprise and Pro editions, will be offered the latest Windows 10 Feature Update based on device compatibility and Windows Update for Business deferral policy. This does not apply to long-term servicing editions.</p></div></div></div></div><p> </p></div><h2>Known issues in this update</h2><div><p>Microsoft is not currently aware of any issues with this update.</p></div><h2>How to get this update</h2><div><p>This update will be downloaded and installed automatically from Windows Update. To get the standalone package for this update, go to the <a href="http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4284860">Microsoft Update Catalog</a> website.</p><p><strong>File information</strong></p><p>For a list of the files that are provided in this update, download the <a data-content-id="" data-content-type="" href="http://download.microsoft.com/download/1/C/7/1C7C419E-6213-4FA8-ABD7-D6E09C54437F/4284860.csv" target="">file information for cumulative update 4284860</a>.</p></div></body></html>