Your antivirus may clash with Windows Meltdown-Spectre patch Watch Now

Video: Your antivirus may clash with Windows Meltdown-Spectre patch

Microsoft won't let you install future security updates until your antivirus vendor sets a specific registry key that certifies compatibility with Windows.

As part of this week's security updates for the Meltdown and Spectre CPU attacks, Microsoft required that all third-party antivirus vendors confirm compatibility with its CPU fixes and then to set a registry key in their products to certify compatibility. Without the key being set, Microsoft's security update simply won't install.

Microsoft has now clarified that this new rule will apply to all future security updates and means users running non-conforming third-party antivirus won't be protected by Microsoft's future patches.

"Customers will not receive the January 2018 security updates (or any subsequent security updates) and will not be protected from security vulnerabilities unless their antivirus software vendor sets the following registry key", Microsoft's updated support page says.

A point to clarify though is that Microsoft won't enforce this requirement indefinitely, but rather only until it sees enough machines have applied the January 3 CPU fixes. As it notes in the FAQ on the issue:

Microsoft added this requirement to ensure customers can successfully install the January 2018 security updates. Microsoft will continue to enforce this requirement until there is high confidence that the majority of customers will not encounter device crashes after installing the security updates.

During testing of the patches for the two attacks, Microsoft discovered some antivirus had been making "unsupported calls into Windows kernel memory" that stop a machine from booting or cause blue screen of death (BSOD) errors after the patch is applied. To avoid this issue, it introduced the new rules.

Security researcher Kevin Beaumont has compiled a list of antivirus products that are both compatible with Microsoft's CPU update and have the required Windows registry key set correctly. As ZDNet reported earlier this week, some vendors are doing both, while others have only confirmed compatibility.

Download now: IT leader's guide to reducing insider security threats

However, it seems conventional antivirus products meet both requirements, while next-generation security products have only confirmed compatibility.

Image: CNET

Beaumont said Microsoft is using the new certification process to prevent antivirus vendors bypassing Microsoft's Kernel Patch Protection, which it introduced in 2007 to defend against rootkits.

As he notes, the bypass technique some vendors are using is similar to the way rootkits work, which involves injecting their product into a Windows hypervisor to intercept system calls to memory locations that Microsoft changed in response to the Meltdown attack.

"Because some antivirus vendors are using very questionable techniques they end up [causing] systems to blue screen of death -- aka get into reboot loops. This shouldn't be possible in the latest operating systems, but some antivirus vendors have managed it by taking themselves into the hypervisor... Antivirus makers really shouldn't be messing with systems like this."

He estimates there are five key vendors that use this technique. Beaumont argues Microsoft should set a date for when it will no longer require the compatibility registry key or risk a large number of machines going without patches. On the flip side, the vast majority of consumer PCs would not be using next-gen security products.

Currently, the list of fully compatible antivirus currently includes Avast, AVG, Avira, Bitdefender, ESET, F-Secure, Kaspersky, Malwarebytes, Sophos, and Symantec. McAfee, Trend Micro, and Webroot are among the firms that will soon join this group.

However, next-gen security providers including CrowdStrike, Cylance, FireEye, and Palo Alto Networks have only confirmed compatibility but so far haven't been willing to set the specific registry key.

Next-gen providers claim they're not setting the registry key because they don't want to risk causing a BSOD in the event a customer also has other antivirus software installed.

A problem with next-gen providers not setting the registry key is that their products used to be sold as an addition to legacy antivirus, but are now being sold as the primary antivirus.

So customers who've made that switch must manually set the registry key to install the updates, something that Microsoft says should only be undertaken with extreme caution.

Update, January 11: CrowdStrike confirms that it has now set the registry key.

Update, January 19: Palo Alto Networks says it is "actively working on an update that will automatically set this registry key, which will be released in the coming weeks".

Previous and related coverage

Antivirus firms are playing patch catch-up, as Microsoft releases Meltdown firmware updates for Surface devices.

Microsoft says your antivirus software could stop you from receiving the emergency patches issued for Windows.

Most Intel processors and some ARM chips are confirmed to be vulnerable, putting billions of devices at risk of attacks. One of the security researchers said the bugs are "going to haunt us for years."

Following claims the patches trapped some AMD PCs in an endless loop, Microsoft today announced the Windows updates would not be rolled out to affected machines.

Practically every modern processor is vulnerable. We're updating this list of fixes as they become available.