Your antivirus must be compatible with Microsoft's Meltdown-Spectre fixes for you to get patches this month or in future.
Microsoft won't let you install future security updates until your antivirus vendor sets a specific registry key that certifies compatibility with Windows.
As part of this week's security updates for the Meltdown and Spectre CPU attacks, Microsoft required that all third-party antivirus vendors confirm compatibility with its CPU fixes and then to set a registry key in their products to certify compatibility. Without the key being set, Microsoft's security update simply won't install.
Microsoft has now clarified that this new rule will apply to all future security updates and means users running non-conforming third-party antivirus won't be protected by Microsoft's future patches.
"Customers will not receive the January 2018 security updates (or any subsequent security updates) and will not be protected from security vulnerabilities unless their antivirus software vendor sets the following registry key",
Microsoft's updated support page notes.
During testing of the patches for the two attacks, Microsoft discovered some antivirus had been making "unsupported calls into Windows kernel memory" that stop a machine from booting or cause blue screen of death (BSOD) errors after the patch is applied. To avoid this issue, it introduced the new rules.
Security researcher
Kevin Beaumont has compiled a list of antivirus products that are both compatible with Microsoft's CPU update and have the required Windows registry key set correctly. As ZDNet reported earlier this week, some vendors are doing both, while others have only confirmed compatibility.
However, it seems conventional antivirus products meet both requirements, while next-generation security products have only confirmed compatibility.
Beaumont explains Microsoft is using the new certification process to prevent antivirus vendors bypassing Microsoft's
Kernel Patch Protection, which it introduced in 2007 to defend against rootkits.
As he notes, the bypass technique some vendors are using is similar to the way rootkits work, which involves injecting their product into a Windows hypervisor to intercept system calls to memory locations that Microsoft changed in response to the Meltdown attack.
"Because some antivirus vendors are using very questionable techniques they end up [causing] systems to blue screen of death -- aka get into reboot loops. This shouldn't be possible in the latest operating systems, but some antivirus vendors have managed it by taking themselves into the hypervisor... Antivirus makers really shouldn't be messing with systems like this."
He estimates there are five key vendors that use this technique. Currently, the list of fully compatible antivirus currently includes Avast, AVG, Avira, Bitdefender, ESET, F-Secure, Kaspersky, Malwarebytes, Sophos, and Symantec. McAfee, Trend Micro, and Webroot are among the firms that will soon join this group.
However, next-gen security providers including CrowdStrike, Cylance, FireEye, and Palo Alto Networks have only confirmed compatibility but so far haven't been willing to set the specific registry key.
Next-gen providers claim they're not setting the registry key because they don't want to risk causing a BSOD in the event a customer also has other antivirus software installed.
A problem with next-gen providers not setting the registry key is that their products used to be sold as an addition to legacy antivirus, but are now being sold as the primary antivirus.
So customers who've made that switch must manually set the registry key to install the updates, something that Microsoft says should only be undertaken with extreme caution.
source
