Intel published a technical advisory around the Intel Processor Machine Check Error vulnerability that is assigned CVE-2018-12207. Microsoft has released updates to help mitigate this vulnerability for guest Virtual Machines (VMs) but the protection is disabled by default. In this post, we will show you how to enable Intel Processor Machine Check Error vulnerability protection in Windows 10.
Intel processors that support machine check architecture have a mechanism to detect and report hardware errors (such as system bus, ECC, parity, cache, and TLB errors) to system software. The machine check architecture enables the processor to generate a machine check exception to signal the detection of a machine check error. This allows system software and OS developers to gracefully shut down the system when hardware error conditions are detected on the platform.
Enable Intel Processor Machine Check Error vulnerability protection
Enabling or disabling this protection requires an action on the Hyper-V hosts running untrusted VMs. Follow the instruction below to set a registry setting to enable or disable this protection on the Hyper-V hosts running untrusted VMs.
Here’s how:
To enable, do the following;
Launch command prompt in admin mode.
In the command prompt, copy and paste the command below:
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v IfuErrataMitigations /t REG_DWORD /d 1 /f
Shutdown and then restart all Guest VMs running on the Hyper-V host.
To disable, do the following;
Launch command prompt in admin mode.
In the command prompt, copy and paste the command below:
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v IfuErrataMitigations /t REG_DWORD /d 0 /f
Shutdown and then restart all Guest VMs running on the Hyper-V host.
That’s it!
