Critical SQL Server Patches for Meltdown and Spectre

Question

Post reply

Critical SQL Server Patches for Meltdown and Spectre

Steve Jones - SSC Editor

SSC Guru

Points: 736212
More actions
January 4, 2018 at 1:51 pm

#77495

Comments posted to this topic are about the item Critical SQL Server Patches for Meltdown and Spectre

Viewing 15 posts - 1 through 15 (of 36 total)

You must be logged in to reply to this topic. Login to reply

Eirikur Eiriksson SSC Guru Points: 182911 More actions · Answer 1

Eirikur Eiriksson

SSC Guru

Points: 182911

January 5, 2018 at 4:12 am

#1974635

Thanks Steve
😎

Thomas Rushton SSC-Insane Points: 22649 More actions · Answer 2

Thanks Steve. Can you please link to the MS KB for SQL Server? https://support.microsoft.com/en-us/help/4073225/guidance-for-sql-server

It looks as though you meant to in this passage:

SQL Server Patches
There is a KB that discusses the attacks. You can read that in
Here are the patches as of this time:

Thomas Rushton
blog: https://thelonedba.wordpress.com

darthmetatron SSC Journeyman Points: 87 More actions · Answer 3

darthmetatron

SSC Journeyman

Points: 87

January 5, 2018 at 6:50 am

#1974673

Seems like an advertisement for Azure. Fake News?

eg61088 SSC Enthusiast Points: 188 More actions · Answer 4

Can someone explain why both the OS and SQL Server should be patched? Wouldn't OS patching cover everything?

Jeff Moden SSC Guru Points: 1004339 More actions · Answer 5

eg61088 - Friday, January 5, 2018 7:48 AM
Can someone explain why both the OS and SQL Server should be patched? Wouldn't OS patching cover everything?

Read the documentation at the links provided. It explains. There's also a micro (firmware) change required in some cases.

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

Jeff Moden SSC Guru Points: 1004339 More actions · Answer 6

Steve, thanks a ton for putting this together especially on "repeat Friday". It sure did make finding things easy.

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

HappyGeek SSCoach Points: 18729 More actions · Answer 7

HappyGeek

SSCoach

Points: 18729

January 7, 2018 at 5:10 am

#1974824

Thanks for the heads up on this Steve.

...

Steve Jones - SSC Editor SSC Guru Points: 736212 More actions · Answer 8

darthmetatron - Friday, January 5, 2018 6:50 AM
Seems like an advertisement for Azure. Fake News?

Care to elaborate?

Steve Jones - SSC Editor SSC Guru Points: 736212 More actions · Answer 9

ThomasRushton - Friday, January 5, 2018 4:17 AM
Thanks Steve. Can you please link to the MS KB for SQL Server? https://support.microsoft.com/en-us/help/4073225/guidance-for-sql-server

Done

HappyGeek SSCoach Points: 18729 More actions · Answer 10

Have applied the patches to Dev servers, not sure if it is my setup, but the GUI did not give warning a server restart was required, but looking at the log file there was an entry saying server restart required! Everything appeared to be OK, but restarted anyway, would like to know what anyone else experiences. This was for both SQL2016 and 2017.

...

david.abram SSCommitted Points: 1777 More actions · Answer 11

Caution needs to be aired when following the recommendations in the SQL KB article (https://support.microsoft.com/en-us/help/4073225/guidance-for-sql-server) when you are using hosting a SCCM Config Manager database.

A Technet blog says (link below);

"Currently, we recommend following the SQL guidance for Configuration Manager site database servers, except the following suggested steps which may impact Configuration Manager functionality and performance. Do not perform the steps for these two categories at this time:

Running SQL Server with CLR enabled (sp_configure ‘clr enabled’, 1)
Using Linked Servers (sp_addlinkedserver)

Link: https://blogs.technet.microsoft.com/configurationmgr/2018/01/08/additional-guidance-to-mitigate-speculative-execution-side-channel-vulnerabilities/

I hope that helps.

Thomas Rushton SSC-Insane Points: 22649 More actions · Answer 12

There's an interesting take on the problem from the ICO (the Information Commissioner's Office in the UK), linking this to GDPR, and the responsibility to patch systems regularly.

Failure to patch known vulnerabilities is a factor that the ICO takes into account when determining whether a breach of the seventh principle of the Data Protection Act is serious enough to warrant a civil monetary penalty. And, under the General Data Protection Regulation taking effect from May 25 this year, there may be some circumstances where organisations could be held liable for a breach of security that relates to measures, such as patches, that should have been taken previously.

from https://iconewsblog.org.uk/2018/01/05/meltdown-and-spectre/

This could get expensive if patching isn't done... :-/

Thomas Rushton
blog: https://thelonedba.wordpress.com

Thom A SSC Guru Points: 99130 More actions · Answer 13

Patches for SQL Server 2008 have been released, just waiting on 2012 and 2014, and SQL Server 2017 on Linux (possibly Docker too) now:
SQL Server 2008 SP4 GDR
SQL Server 2008 R2 SP3 GDR

Thom~

Excuse my typos and sometimes awful grammar. My fingers work faster than my brain does.
Larnu.uk

Thom A SSC Guru Points: 99130 More actions · Answer 14

Thom A - Wednesday, January 10, 2018 4:55 AM
Patches for SQL Server 2008 have been released, just waiting on 2012 and 2014, and SQL Server 2017 on Linux (possibly Docker too) now:
SQL Server 2008 SP4 GDR
SQL Server 2008 R2 SP3 GDR

Nevermind, my Ubuntu Machine just patched SQL Server 2017 to CU3-GDR.

Thom~

Excuse my typos and sometimes awful grammar. My fingers work faster than my brain does.
Larnu.uk