Here is Microsoft's Security Advisory on the vulnerabilities, which have been assigned three "CVE" numbers:
- CVE-2017-5715 - Branch target injection ("Spectre")
- CVE-2017-5753 - Bounds check bypass ("Spectre")
- CVE-2017-5754 - Rogue data cache load ("Meltdown")
The Microsoft KB for how these vulnerabilities impact SQL server is being actively updated as new information becomes available:
KB 4073225: SQL Server Guidance to protect against speculative execution side-channel vulnerabilities.
Microsoft's exact recommendation will depend on your configuration and business scenario, please refer to the KB for details. If you are hosting on Azure, for example, no action is required (the environment is already patched). If, however, you are hosting applications in shared virtual or physical environments with potentially untrusted code, other mitigations may be required.
SQL patches are currently available for the following impacted SQL versions:
These SQL server patches protect against CVE 2017-5753 (Spectre: Bounds check bypass).
To protect against CVE 2017-5754 (Meltdown: Rogue data cache load), you can enable Kernel Virtual Address Shadowing (KVAS) on Windows (via registry change) or Linux Kernel Page Table Isolation (KPTI) on Linux (via a patch from your Linux distributor).
To protect against CVE 2017-5715 (Spectre: Branch target injection), you can enable Branch Target Injection mitigation hardware support (IBC) via registry change plus a firmware update from your hardware manufacturer.
Note that KVAS, KPTI and IBC may not be required for your environment, and these are the changes with the most significant performance impact (emphasis mine):
Microsoft advises all customers to install updated versions of SQL Server and Windows. This should have negligible to minimal performance impact to existing applications based on Microsoft testing of SQL workloads, however, we recommend that you validate before deploying to a production environment.
Microsoft has measured the impact of Kernel Virtual Address Shadowing (KVAS), Kernel Page Table Indirection (KPTI) and Branch Target Injection Mitigation (IBC) on various SQL workloads in various environments and found some workloads with significant degradation. We recommend that you validate the performance impact of enabling these features before deploying into a production environment. If the performance impact of enabling these features is too high for an existing application, customers can consider whether isolating SQL Server from untrusted code running on the same machine is a better mitigation for their application.
Microsoft System Center Configuration Manager (SCCM) specific guidance:
Additional guidance to mitigate speculative execution side channel vulnerabilities as of Jan 08 2018.
Related blog posts: