Archive for the ‘SQL’ category

Why you should plan now to upgrade you SQL server

September 16th, 2018

Developments in software, hardware, and storage technology make the next twelve to eighteen months an ideal time to migrate from a legacy version of SQL Server to a modern version of SQL Server.

Consider that any version of SQL Server prior to SQL Server 2016 is already a legacy version of SQL Server.
- SQL Server 2014 will fall out of mainstream support on July 9, 2019
- (the same date that SQL Server 2008 and SQL Server 2008 R2 will fall out of extended support).
- SQL Server 2012 fell out of mainstream support on July 11, 2017.

Customers on those platforms, should be budgeting for what to do before the support expires.
Many new features were introduced at SQL 2016 and 2017. SQL Server 2017 is a clearly better upgrade choice than SQL Server 2016 right now. (SQL 2014 is best forgotten!)

Options:
Keep using the software and accept that it won’t receive any more security updates. This leaves you unprotected and is not a recommended course of action in the current era of malware, phasing attacks and GDPR compliance. Potentially the most expensive option ..and you will in any case need to upgrade sooner than later.
• Upgrade to newer software versions that are still supported . Update your on-prem SQL Server 2017 and Windows Server 2016 to get the necessary security, innovation, performance and efficiency. Resource intensive and maybe an expensive option.
Pay Microsoft for a custom support contract - If you have Software Assurance or Subscription licenses under an Enterprise Agreement, then get extended security updates for 3 years by paying 75% of the full license fee for SQL Server or Windows Server. Most expensive option.
Migrate your SQL 2008 workloads onto the Azure platform. Pay nothing for 3 years for support –maybe the least risky option • This choice gets you the necessary critical patches and allows you to keep data safe for >3 years. This give you the time and flexibility to prepare for a next move with SQL. Worth considering. Eligible customers can use Azure Hybrid Benefit and take advantage of existing on-premises licenses for Windows Server and SQL Server to save on Azure Virtual Machines (IaaS) or Azure SQL Database Managed Instance (PaaS) charges. Azure SQL Database reserved capacity is also available and enables you to save up to 33 percent when pre-paid SQL database vCores are taken for a one or three-year term.

Moving to the Cloud is a challenging project for many organisations. Consider booking our Cloud Migration workshop half day session to investigate and define a path for moving workloads, including SQL databases, into Azure. The workshop includes:
• Review of Azure Services.
• Identity the infrastructure required to get started.
• Review of existing workloads and migration paths.
• Administration, Maintenance and Controls.
• Security and Privacy.
• Developing a Cloud Adoption Roadmap.
• Planning a proof-of-concept to begin the journey.

SQL Server Developments

The modern versions of SQL Server are SQL Server 2016, SQL Server 2017, and the upcoming release of SQL Server

When the next version of SQL Server is released (perhaps in Q4 this year ) it is likely to have useful new features and enhancements that will make it a superior upgrade choice to SQL Server 2017. Regardless of new features, the next version of SQL Server will be in mainstream support for a longer period than SQL Server 2016 or SQL Server 2017.

Operating System Developments
Microsoft will release Windows Server 2019 sometime later in 2018. There are a number of improvements in Storage Spaces Direct (S2D), including deduplication and compression in ReFS:
- Another improvement is True Two-Node quorum for two-node S2D clusters using a USB thumb drive as a file share in a router.
- Windows Server 2019 S2D will let you have up to 4PB of raw storage capacity per S2D cluster, which is a 4X improvement over Windows Server 2016.
- There is a new PoSH cmdlet called Get-PhysicalDiskIoReport that lets you view much more granular performance information for individual physical disks, that allows you to manually monitor drive latency, and can be used to automatically detect drive latency outliers.
- Windows Server 2019 fully supports existing NV-DIMM persistent memory, along with Intel Optane 3D XPoint memory and storage. There are also improvements in the free Windows Admin Center management utility that is a great dashboard for hyper-converged infrastructure (HCI) deployments.
- VMware vSphere 6.7 supports vSphere Persistent Memory, which will let you take advantage of persistent memory in a VMware virtualized environment.

Hardware Developments
Both Intel and AMD are scheduled to release new generations of server processors during the next three to six months, both of which will work in existing model servers.
The Intel, 14nm Intel Xeon Scalable Processor “Cascade Lake-SP” is rumored to be due in Q4 of 2018. These processors will support “Apache Pass” DIMMs (meaning Intel Optane 3D XPoint persistent memory) and they are socket compatible with current Intel Xeon Scalable Processor “Skylake-SP” processors, which means that they will work in existing server models. More important for many customers is the fact that Cascade Lake-SP will have hardware-level protection for most side-channel attacks (such as Spectre/Meltdown), which will have less performance impact than software-based mitigation techniques. The Cascade Lake-SP processors will be followed by 14nm “Cooper Lake-SP” in 2019, and then 10nm “Ice Lake-SP” server processors in 2020.

Intel’s continued struggles with 10nm manufacturing are definitely going to hurt their competitive position compared to AMD in 2019/2020 so AMD stands to gain significant market share from Intel in the server space during this period.
AMD will have the 2nd generation, 7nm “Zen2” EPYC “Rome” family processors in early-mid 2019. These processors are supposed to be socket compatible with existing server models and have up to 48 cores/ 96 threads per processor. These processors are also rumored to have PCIe 4.0 support, which will give them double the bandwidth per lane compared to PCIe 3.0.

Looking further out, AMD is planning a3rd generation 7nm+ “Zen3” EPYC “Milan” family of processors sometime in 2020.

Storage Developments
Intel released its first 3D XPoint storage product, the 375GB Intel Optane DC P4800X SSD in Q1 2017. These use a PCIe 3.0 x4 link along with the NVMe protocol, and they have roughly 10X lower latency and 5-8X better throughput at low queue depths compared to the fastest PCIe NVMe NAND-based SSDs.
They also have 2-4X better write endurance than enterprise NAND-based SSDs.
These are relatively inexpensive and offer the fastest currently available type of traditional block mode storage. These are transparent to SQL Server and will work in any system that supports PCIe 3.0 x4 slots as HHHL add-in cards or U.2 connected drives.

Expected in the very near future the Intel 3D XPoint-based DIMMs (“Apache Pass”) that use a traditional low-latency DDR4 memory interface and form factor. These DIMMs will be available in 128GB, 256GB, and 512GB capacities, and they will fit in DDR4 memory slots. They will be addressable in a lower performance block mode that uses the entire storage stack, or a much higher performance direct access (DAX) mode that is byte addressable and bypasses the storage stack.

Both Windows 10 and Windows Server 2016 already have DAX support, and SQL Server 2016 SP1 has the persistent log buffer feature that lets you leverage a DAX storage volume that is built on persistent memory to create a small additional 20MB transaction log file that is used to greatly reduce latency writing to the transaction log. It seems probable that the next release of SQL Server will improve this feature.

Windows Server 2019 will have even better support for persistent memory. New two-socket servers with Intel Xeon “Cascade Lake-SP” processors will support up to 6TB of 3D XPoint DIMMs, which can be combined with traditional DDR4 memory in other memory slots.

SQL updates August 2018

August 16th, 2018

Microsoft has released a series of updates to SQL Server 2016 and 2017 to fix CVE-2018-8273:

– Executing a specially crafted query involving calculating difference between values of different date types and aggregation of the results, could lead to stack corruption, if the query runs in batch mode. Depending on particular values processed by such query, this could lead to terminating the SQL Server process, or a possibility of remote code execution.

- A buffer overflow vulnerability exists in the Microsoft SQL Server that could allow remote code execution on an affected system. An attacker who successfully exploited this vulnerability could execute code in the context of the SQL Server Database Engine service account…. The security update addresses the vulnerability by modifying how the Microsoft SQL Server Database Engine handles objects in memory.

The updates include:
•2017 CU9 GDR – 14.0.3035.2 – install this if you’re on the latest 2017, CU9
•2017 RTM GDR – 14.0.2000.63 – install this if you’re still on RTM
•2017 on Linux – 14.0.3035.2-1 and 14.0.2002.14 depending on your branch
•2016 SP2 CU2 GDR – 13.0.5161.0 – install this if you’re on the latest 2016, SP2 CU2
•2016 SP2 GDR – 13.0.5081.1 – install this if you’re still on SP2
•2016 SP1 CU10 GDR – 13.0.4522.0 – install this if you’re still on SP1 CU10
•2016 SP1 GDR – 13.0.4223.10 – install this if you’re still on SP1 with no CUs

Microsoft Ignite agenda insights to the future road map

August 14th, 2018

Microsoft recently published the session list for its annual Ignite IT Pro conference happening at the end of the September. Alook at the topcis gives a clue to its roadmap. There sessionson on the next version of SQL Server. Surface Hub 2 and Surface Go with LTE, Intune and Windows Autopilot, Windows Server 2019. New Remote Desktop services.

Last year, Microsoft used Ignite to highlight AI, intelligent edge and its futuristic quantum-computing technologies but overall the listed sessions, look more down to earth. There are two mixed-reality sessions — including “Visio Immersive,” Almost 100 listed sessions touch on AI . At Inspire Microsoft told partners the “AI Accelerate Kit”would be coming in October and include AI use cases, best practices and “Ethical AI” guidance so that seems lilley to be included.

At Ignite Microsoft will again focus on Microsoft 365,- the bundle of Windows 10, Office 365 and Intune security/management technologies.

Expect to a lot of Dynamics 365 CRM and ERP content — because October is when the next feature update will arrive for the suite of Dynamics products.

There seems to be more developer content: . ASP.NET, Visual Studio Code and Visual Studio 2017, Node.js, and sessions on linux and Docket containers, Progressive Web Apps and MSIX, the new Windows 10 application-packaging technology Microsoft is rolling out.

There are 115 sessions listed for SQL Server /Azure SQL. Mayeb we will get an insight into the successor to SQL Server 2017 — codenamed “Aris,” which is currently in private Community Technology Preview testing.

Microsoft wil lalso show the new the Surface Hub 2 and Surface Go.

Expect Windows Server 2019, Microsoft’s next major release of Windows Server, to be a hot topic -it’s due to start roll out before year end.

https://www.microsoft.com/en-us/ignite

https://www.microsoft.com/en-us/ignite/faq

September 24–28, 2018 | Orlando, Florida

SQL Server 2016 SP2 CU2, SP1 CU10

July 18th, 2018

Fixes and improvements:
• DAG improvement – automatically seed replicas – when you add a database to an existing AG, SQL Server can automatically seed it across the secondary replicas. .
• AGs – configurable session_timeouts
• AGs – slow transactions with 1 sync and 1 async secondary
• AGs – on cross-data-center AG failover, you get a non-yielding scheduler and a crash
• AGs – queries on secondary take twice as long
• AGs – VSS backups fail on secondary replicas in a Basic Availability Group (which technically you’re not supposed to do, but you can still back up the entire secondary VM, and that’s where the problem looks like it’s coming in)
• AGs – fixing error 19432 for duplicate log blocks
• Log shipping – add support for Transparent Data Encryption by configuring MAXTRANSFERSIZE.
• Dynamic data masking doesn’t
• SSAS crashes when Process Full follows Process Clear –“you will notice that the SSAS may crash.” .
• Memory dump when you merge partitioned temporal tables .
• Stats updates can get a “corrupted index” message and a disconnect
• Assertion error when you add a database
• Slow performance when Query Store is enabled
• Non-yielding schedulers require a reboot – not the most informative KB article ever. “Assume that you have a Microsoft SQL Server 2016 installed.” .

See KB articles for more information . Download SQL 2016 SP2 CU2 and/or SP1 CU10.

https://support.microsoft.com/en-us/help/4341569/cumulative-update-10-for-sql-server-2016-sp1

End of life for SQL 2008 and 2008 r2 is only a year away

July 14th, 2018

On July 9, 2019, Microsoft will end Extended Support, for SQL Server 2008 and 2008 R2hich means no more updates or support of any kind, potentially leaving you vulnerable to security and compliance issues.
Some considerations:
That is only a year away. So time to start planning and to get it into your 2019 budget.
What applications are affected? With what new SQL version are they compatible?
Will you need to rebuy licenses? The SQL license cost is now core based and it might prove lot higher than last time so take the time to consider all options.
Should any of your applications move to the cloud?
Should you also look at upgrades to Hardware? Windows, Office, Exchange, or Business finance/erp systems in conjunction with SQL?
Is now the time to review your security solutions?
Are you going to expand, or implement heavy new processes like consolidation, budgeting, BI in then next 2-3 years?
Is your mobile network growing?

There are major enhancements at QL 2016 sp1 so we recommend you should not consider any version lower than that. By next year SQL 2017 will also have settled down.

To discuss options callus o 0097143365589

SQL training in Arabic – free on line course

June 26th, 2018

A free video course presented in Arabic to help you learn about SQL Server 2012. The course covers a number of concepts important to database professionals such as installation, configuration, storage, backup, security and high availability/disaster recovery concepts. Ayman El-Ghazali narrates the course in the Arabic language and demonstrates the skills so you can follow along on your own instance. You can find the videos and more information here.

https://thesqlpro.com/ArabicSQL/

SQL 2016 Servcies packs May 2018

May 31st, 2018

SQL Server 2016 Service Pack 2 came out last month, but Microsoft also just released Service Pack 1 Cumulative Update 9, which has fixes that aren’t in Service Pack 2:
•PFS page round robin algorithm improvement
•Fixed PAGELATCH_EX and PAGELATCH_SH waits in TempDB
•Change tracking is inconsistent during an update on a table with a clustered index
•TDE database goes offline during a log flush

However, they also just released 2016 SP2 CU1! https://support.microsoft.com/en-us/help/4135048/cumulative-update-1-for-sql-server-2016-sp2

SQL Server 2016 Service Pack 2

April 25th, 2018

SQL Server 2016 Service Pack 2 is released. This SP2 release includes the hotfixes from all released 2016 cumulative updates: SQL Server 2016 CU1 through SP1 CU8.

SQL Server 2016 Updates
Each update is linked to its Microsoft knowledge base article with the download and the list of hotfixes included. The dates show the end of support date

SP2 2018/04/24 13.0.5026.0 2026/07/14
CU8 2018/03/19 13.0.4474.0 2019/04/24
CU7 2018/01/04 13.0.4466.4 2019/04/24
CU6 2017/11/22 13.0.4457.0 2019/04/24
CU5 2017/09/18 13.0.4451.0 2019/04/24
CU4 (w/MDS bug) 2017/08/08 13.0.4446.0 2019/04/24
CU3 2017/05/15 13.0.4435.0 2019/04/24
CU2 2017/03/20 13.0.4422.0 2019/04/24
CU1 2017/01/18 13.0.4411.0 2019/04/24
SP1 2016/11/16 13.0.4001.0 2019/04/24
CU9 2017/11/22 13.0.2216.0 2018/01/09 – out of support
CU8 2017/09/18 13.0.2213.0 2018/01/09 – out of support
CU7 2017/08/08 13.0.2210.0 2018/01/09 – out of support
CU6 2017/05/15 13.0.2204.0 2018/01/09 – out of support
CU5 2017/03/28 13.0.2197.0 2018/01/09 – out of support
CU4 2017/01/18 13.0.2193.0 2018/01/09 – out of support
CU3 2016/11/17 13.0.2186.6 2018/01/09 – out of support
CU2 (see note 1 and note 2) 2016/09/22 13.0.2164.0 2018/01/09 – out of support
CU1 2016/07/25 13.0.2149.0 2018/01/09 – out of support
None (RTM) 2016/06/01 13.0.1601.5 2018/01/09 – out of support

Note 1: CU2 has a known issue with Filestream not working when SecureBoot is enabled. If you’re on Windows Server 2016 or Windows 10, and using SecureBoot (which is enabled by default with Hyper-V Gen2 VMs), and your database has Filestream, then either need disable SecureBoot, or skip CU2 for now.

Note 2: columnstore index users should consider the on-demand hotfix update 13.0.2170.0, which includes serious performance and reliability fixes.

Warnin read the bottom note about “Uninstalling SQL Server 2016 SP2 (Not recommended): there some new features which once installed may give issues if you then try to uninstall.

https://www.microsoft.com/en-us/download/details.aspx?id=56836

Microsoft public preview of Azure SQL Database Managed Instances – running SQL Server workloads in the cloud

March 10th, 2018

Microsoft released the public preview of Azure SQL Database Managed Instances – a new option for running SQL Server workloads in the cloud.

Managed Instances (or Azure SQL Database Managed Instances, are a new PaaS database offer that joins the Azure SQL Database and Elastic Pool services. Within this PaaS family, Managed Instances take care of operational aspects like ensuring: high availability, backups, and applying patches, making these simpler and less time-consuming to administer.

While many organizations have benefited from using Azure SQL Database for new applications, it has been a significant challenge to migrate existing workloads because of key functionality gaps versus on-premises SQL Server.

Managed Instances address that problem, by providing vastly improved compatibility. Organizations can therefore more easily migrate existing on-premises SQL Server workloads to the cloud while retaining many of the manageability benefits of a PaaS offering.

Managed Instances require less operational oversight compared to traditional on-premises SQL Server,. Use of the service however, doesn’t free you from the responsibility for checking availability or ensuring that security is configured appropriately. It also remains the DBA’s responsibility to optimize performance, and to handle other operational concerns like making sure jobs complete successfully, or general troubleshooting – its platform as a service. High availability, automated backups, point-in-time restore, automatic plan correction, threat detection, vulnerability assessment, and other intelligent features are built-in into service without any additional charge. OS patching and database upgrades are handled automatically and do not require any action.

In addition to built-in monitoring and maintenance features, you can use any 3rd-party tool to monitor and manage your instance, because most of the system views are exposed.

Connectivity

Azure SQL Managed Instance is not a service on public endpoint. Azure SQL Managed Instance is placed on private IP address in your VNET. It is just hosted and managed by Azure cloud.

Currently, Azure SQL Database PaaS has two main offers for the customers who use SQL Server database and want to migrate to PaaS:
1.Managed Database – isolated and self-contained database service that has database scoped functionalities.
2.Elastic pool – a group of Azure SQL databases that share the same resource.

However, current Azure SQL Database offers don’t provide entire SQL Server “Instance as a Service” as PaaS model. As a result, some of the instance-level features in Azure SQL Database PaaS such as SQL Agent or linked servers are not supported because they are not applicable on the database level.

Currently, the only way to get the full SQL Server instance in Azure is to use Azure SQL VM that handles underlying infrastructure (e.g. disks), but still not have some SQL PaaS features as Azure SQL Database.

Managed Instance is a SQL Server Instance in Azure cloud that shares the same code with the latest version of SQL Server Database Engine and has the latest features, performance improvements, and security patches. It has most of the SQL Server 2017 features (excluding some on-premise Windows features such as Windows logins or potentially harmful features such as extended stored procedures) and enables you to put almost any database that you have in on-premises SQL Server instance. Every instance is fully isolated from the other customer instance and placed in your dedicated subnet with assigned private ip addresses.

Security/Isolation. Managed Instance is a resource in your network hosted by Azure cloud. You have to create Azure VNET and a dedicated subnet where the instance should be deployed. There are networking constraints for the VNET/subnet that you should review before you create a managed instance.

There is no public IP address dedicated to the Managed Instance. Only applications in customer network can access Managed Instance. Network administrators have the full control and can configure access to Managed Instance using standard methods such as Network security Groups and firewalls.

Choose how many CPU cores to use and how much storage you need. You can create a Managed Instance with 16 cores and 500GB storage, and then increase or decrease these numbers depending on your needs. Changing CPU or storage in instance can be done via Azure portal using simple slider.

Managed Instance has split compute and storage components. There are compute nodes with 8, 16, or 24 cores, that work with database files stored on Azure Premium disk storage. Every database file is placed on separate Azure premium disk, that guarantees that database files cannot be lost. Although Managed Instance relies on Azure Premium disks, it also has separate backup mechanism that ensures that even if something would happen with the files, platform would still be able to restore files from backups.

SQL 2008 Extended support ends July 2019

March 4th, 2018

A remdnder that Mainstream Support for SQL Server 2008 and SQL Server 2008 R2 ended on July 8, 2014. – Support Lifecycle policy, found in http://support.microsoft.com/lifecycle.

Customers are encouraged to prepare and execute on their upgrade and/or sustained engineering plans as early as possible for these SQL versions. Remaining current on your SQL Server version ensures that your product remains supported per the Support Lifecycle policy. Additionally, your software benefits from the many enhancements, fixes, and security updates provided through the latest releases.

For both SQL Server 2008 and SQL Server 2008 R2, Microsoft will continue to provide technical support which also includes security updates during the duration of extended support. See the table below for extended support end date. Non-security hotfixes for these versions will be offered only to customers who have an Extended Hotfix Support agreement.

SQL Server 2017 Cumulative Update 4

March 4th, 2018

Last month Microsoft released SQL Server 2017 Cumulative Update 4, which is Build 14.0.3022.28.

There are 55 hotfixes in the public fix list. Run the special T-SQL script in the release notes if you are using Query Store and previously ever had SQL Server 2017 CU2 installed (and you were using Query Store on any of your databases at that time). The script will look for any plans that were forced while you were running SQL Server 2017 CU2, and if it finds any, it will unforce those and then clear those from Query Store.

There are several updates both for Columnstore indexes and for Availability Groups.

There will not be any Service Packs for SQL Server 2017, so test and deploy SQL Server 2017 Cumulative Updates as they become available.

SQL Server 2017 and later versions will no longer receive SPs
The Modern Servicing Model (MSM)

Starting from SQL Server 2017:
• SPs will no longer be available. Only Cumulative Updates (CUs) and critical updates (GDRs) will be provided.
• CUs will contain localized content if it’s necessary as what SPs have done.
• CUs will be delivered more frequently at first and then less frequently: every month for the first 12 months, and then every quarter for the final four years of the five-year mainstream lifecycle.

Note The MSM only applies to SQL Server 2017 and later versions.

Earlier versions of SQL Server are not affected by this SP policy change. Service Packs (SPs) will continue to be provided for the reminder of mainstream support for SQL Server 2014 and SQL Server 2016.

“Meltdown” and “Spectre and azure.”

February 10th, 2018

Last month as reported on this blog, Intel revealed two critical vulnerabilities they found in Intel chips. These vulnerabilities allow cyber-attackers to steal data from the memory of running apps. This data can include passwords, emails, photos, or documents. Intel dubbed these as: “Meltdown” and “Spectre.”

Microsoft released a patch for Azure the very next day. Just as well because Microsoft Azure is a shared-computing environment by default. One server hosts applications and development of applications, and various Virtual Machines tap into the server to allow employees to and others to access these applications. As such, the Meltdown vulnerability allows an attacker to compromise the host and read all the data from every operating system tapping into it. Around 3-10 million physical servers host Azure, and these servers in turn host tens of millions of Virtual Machines. So impressively Microsoft developed deployed a patch for these vulnerabilities in less than a week’s time. Azure is a cloud-based application and so Microsoft could focus their security team to work on the cloud servers and only the cloud servers. This way, these millions of servers and users had a patch and all applications hosted on the Azure cloud-platform were immediately protected.

A good business case example for business to move to Azure cloud services.

Malware developers are still out there. German antivirus testing firm AV-Test reported 139 samples of malware trying to attack the Meltdown vulnerability in January to exploit those who have not patched.

Microsoft patched their cloud servers, but non-Azure users (as well as all Windows users, period) still need to apply their operating system patches to ensure complete protection. This is one vulnerability you definitely don’t want cyber-attackers to exploit, whether it’s your personal computer or your business’s server.

Meltdown and Spectre – why do these matter?

January 6th, 2018

One of the most basic premises of computer security is isolation: When you run somebody else’s code as an untrusted process on your machine, then you restrict it to its own tightly sealed test environment. Otherwise, it might peer into other processes, or snoop around the computer as a whole. A security flaw in computers’ most deep-seated hardware puts a crack in those walls, as one newly discovered vulnerability in millions of processors has done, it breaks some of the most fundamental protections computers promise—and sends practically the entire industry scrambling.

A bug in Intel chips allows low-privilege processes to access memory in the computer’s kernel, the machine’s most privileged inner sanctum. Theoretical attacks that exploit that bug, based on quirks in features Intel has implemented for faster processing, could allow malicious software to spy deeply into other processes and data on the target computer or smartphone. On multi-

Meltdown affects Intel processors, and works by breaking through the barrier that prevents applications from accessing arbitrary locations in kernel memory. Segregating and protecting memory spaces prevents applications from accidentally interfering with one another’s data, or malicious software from being able to see and modify it at will. Meltdown makes this fundamental process fundamentally unreliable.

Spectre affects Intel, AMD, and ARM processors, broadening its reach to include mobile phones, embedded devices, and pretty much anything with a chip in it. Which, of course, is everything from thermostats to baby monitors now.

It works differently from Meltdown; Spectre essentially tricks applications into accidentally disclosing information that would normally be inaccessible, safe inside their protected memory area. This is a trickier one to pull off, but because it’s based on an established practice in multiple chip architectures, it’s going to be even trickier to fix.
user machines, like the servers run by Google Cloud Services or Amazon Web Services, they could allow hackers to break out of one user’s process, and instead snoop on other processes running on the same shared server.

It’s not a physical problem with the CPUs themselves, or a plain software bug you might find in an application like Word or Chrome. It’s in between, at the level of the processors’ “architectures,” the way all the millions of transistors and logic units work together to carry out instructions.

In modern architectures, there are inviolable spaces where data passes through in raw, unencrypted form, such as inside the kernel, the most central software unit in the architecture, or in system memory carefully set aside from other applications. This data has powerful protections to prevent it from being interfered with or even observed by other processes and applications.

Because Meltdown and Spectre are flaws at the architecture level, it doesn’t matter whether a computer or device is running Windows, OS X, Android, or something else — all software platforms are equally vulnerable. A huge variety of devices, from laptops to smartphones to servers, are therefore theoretically affected. The assumption going forward should be that any untested device should be considered vulnerable.

Not only that, but Meltdown in particular could conceivably be applied to and across cloud platforms, where huge numbers of networked computers routinely share and transfer data among thousands or millions of users and instances.

The one crumb of comfort is that the attack is easiest to perform by code being run by the machine itself — it’s not easy to pull this off remotely. So there’s that, at least.

On Wednesday evening, a large team of researchers at Google’s Project Zero, universities including the Graz University of Technology, the University of Pennsylvania, the University of Adelaide in Australia, and security companies including Cyberus and Rambus together released the full details of two attacks based on that flaw, which they call Meltdown and Spectre.

“These hardware bugs allow programs to steal data which [is] currently processed on the computer,” reads a description of the attacks on a website the researchers created. “While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs.”

Both attacks are based on the same general principle, Meltdown allows malicious programs to gain access to higher-privileged parts of a computer’s memory, while Spectre steals data from the memory of other applications running on a machine. And while the researchers say that Meltdown is limited to Intel chips, they say that they’ve verified Spectre attacks on AMD and ARM processors, as well. With these glitches, if there’s any way an attacker can execute code on a machine, then it can’t be contained.

Meltdown and Spectre

https://twitter.com/brainsmoke/status/948561799875502080

When processors perform speculative execution, they don’t fully segregate processes that are meant to be low-privilege and untrusted from the highest-privilege memory in the computer’s kernel. That means a hacker can trick the processor into allowing unprivileged code to peek into the kernel’s memory with speculative execution.

he processor basically runs too far ahead, executing instructions that it should not execute. .

Retrieving any data from that privileged peeking isn’t simple, since once the processor stops its speculative execution and jumps back to the fork in its instructions, it throws out the results. But before it does, it stores those in its cache, a collection of temporary memory allotted to the processor to give it quick access to recent data. By carefully crafting requests to the processor and seeing how fast it responds, a hacker’s code could figure out whether the requested data is in the cache or not. And with a series of speculative execution and cache probes, he or she can start to assemble parts of the computer’s high privilege memory, including even sensitive personal information or passwords.

Many security researchers who spotted signs of developers working to fix that bug had speculated that the Intel flaw merely allowed hackers to defeat a security protection known as Kernel Address Space Layout Randomization, which makes it far more difficult for hackers to find the location of the kernel in memory before they use other tricks to attack it, but the bug is more serious: It allows malicious code to not only locate the kernel in memory, but steal that memory’s contents, too.

Tough Fix

In a statement responding to the Meltdown and Spectre research, Intel noted that “these exploits do not have the potential to corrupt, modify, or delete data,” though they do have the ability to spy on privileged data. The statement also argued that “many types of computing devices—with many different vendors’ processors and operating systems—are susceptible to these exploits,” mentioning ARM and AMD processors as well.

Microsoft, which relies heavily on Intel processors in its computers, says that it has updates forthcoming to address the problem. “We’re aware of this industry-wide issue and have been working closely with chip manufacturers to develop and test mitigations to protect our customers,” the company said in a statement. “We are in the process of deploying mitigations to cloud services and are releasing security updates today to protect Windows customers against vulnerabilities affecting supported hardware chips from AMD, ARM, and Intel. We have not received any information to indicate that these vulnerabilities had been used to attack our customers.”

Linux developers have already released a fix, apparently based on a paper recommending deep changes to operating systems known as KAISER, released earlier this year by researchers at the Graz University of Technology.

Apple released a statement Thursday confirming that “all Mac systems and iOS devices are affected,” though the Apple Watch is not. “Apple has already released mitigations in iOS 11.2, macOS 10.13.2, and tvOS 11.2 to help defend against Meltdown,” the company said. “In the coming days we plan to release mitigations in Safari to help defend against Spectre. We continue to develop and test further mitigations for these issues and will release them in upcoming updates of iOS, macOS, tvOS, and watchOS.”

Amazon, which offers cloud services on shared server setups, says that it will take steps to resolve the issue soon as well. “This is a vulnerability that has existed for more than 20 years in modern processor architectures like Intel, AMD, and ARM across servers, desktops, and mobile devices,” the company said in a statement. “All but a small single-digit percentage of instances across the Amazon EC2 fleet are already protected. The remaining ones will be completed in the next several hours.”

Google, which offers similar cloud services, pointed WIRED to a chart of Meltdown and Spectre’s effects on its services, which states that the security issue has been resolved in all of the company’s infrastructure.

Those operating system patches that fix the Intel flaw may come at a performance cost: Better isolating the kernel memory from unprivileged memory could create a significant slowdowns for certain processes.

According to an analysis by the Register, which was also the first to report on the Intel flaw, those delays could be as much as 30 percent in some cases, although some processes and newer processors are likely to experience less significant slowdowns. Intel, for its part, wrote in its statement that “performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time.”

Until the patches for Meltdown and Spectre roll out more widely, it’s not clear just what the speed cost of neutering those attacks may turn out to be. But even if the updates result in a performance hit, it is a worthwhile safeguard: Better to put the brakes on your processor, perhaps, than allow it to spill your computer’s most sensitive secrets.

Spectre, is not likely to be fully fixed any time soon. The fact is that the practice that leads to this attack being possible is so hard-wired into processors that the researchers couldn’t find any way to totally avoid it. They list a few suggestions, but conclude:

While the stop-gap countermeasures may help limit practical exploits in the short term, there is currently no way to know whether a particular code construction is, or is not, safe across today’s processors – much less future designs.

Critical Server Patches for Meltdown and Spectre – processor bugs

January 5th, 2018

There is a set of critical bugs in our processors. There are two issues, known as Meltdown and Spectre.

If you haven’t been paying attention, a serious security flaw in nearly every processor made in the last ten years was recently discovered. Initially it was thought to be just Intel, but it appears it’s everyone. The severe design flaw in microprocessors allows sensitive data, such as passwords and crypto-keys, to be stolen from memory is real – and its details have been revealed.
On a shared system, such as a public cloud server, it is possible, depending on the configuration, for software in a guest virtual machine to drill down into the host machine’s physical memory and steal data from other customers’ virtual machines.

This is so serious CERT recommends throwing away your CPU and buying a non-vulnerable one to truly fix the issue.

https://www.kb.cert.org/vuls/id/584653

There are two bugs which are known as Meltdown and Spectre. The Register has a great summarized writeup here – no need for me to regurgitate. This is a hardware issue – nothing short of new chips will eradicate it. That said, pretty much everyone who has written an OS, hypervisor, or software has (or will have) patches to hopefully eliminate this flaw. This blog post covers physical, virtualized, and cloud-based deployments of Windows, Linux, and SQL Server.

The fact every vendor is dealing with this swiftly is a good thing. The problem? Performance will most likely be impacted. No one knows the extent, especially with SQL Server workloads. You’re going to have to test and reset any expectations/performance SLAs. You’ll need new baselines and benchmarks. There is some irony here that it seems virtualized workloads will most likely take the biggest hit versus ones on physical deployments. Time will tell – no one knows yet.

What do you need to do? Don’t dawdle or bury your head in the sand thinking you don’t need to do anything and you are safe. If you have deployed anything in the past 10 – 15 years, it probably needs to be patched. Period. PATCH ALL THE THINGS! However, keep in mind that besides this massive scope, there’s pretty much a guarantee – even on Linux – you will have downtime associated with patching.
Information that you might want to review and decide how to patch your systems.

SQL Server Versions Affected

This is a hardware issue, so every system is affected SQL Server running on x86 and x64 .for these versions:

SQL Server 2008
SQL Server 2008R2
SQL Server 2012
SQL Server 2014
SQL Server 2016
SQL Server 2017
Azure SQL Database

It is likely that SQL Server 2005, SQL Server 2000, SQL Server 7, SQL Server 6.5 are all affected. No SQL Server patches are coming.

Note: according to Microsoft, IA64 systems are not believed to be affected.

SQL Server Patches

There is a KB that discusses the attacks. Here are the patches as of this time:

SQL Server 2017 CU3
SQL Server 2017 GDR
SQL Server 2016 SP1 CU7
SQL Server 2016 SP1 GDR
.
OS Patches

The Window KB for guidance is 4072698. Here are the OS patches that I’ve been able to find.

Windows Server (Server Core) v 1709 – KB4056892
Windows Server 2016 – KB4056890
Windwos Server 2012 R2 – KB4056898
Windows Server 2012 – N/A
Windows Server 2008 R2 – KB4056897
Windows Server 2008 – N/A
Red Hat v.7.3 – Kernel Side-Channel Attacks CVE-2017-5754, 5753, 5715
SUSE Linux – 7022512
Ubuntu – N/A

VMWare has a security advisory (VMSA-2018-0002) and patches. They have released:

ESXi 6.5
ESXi 6.0
ESXi 5.5 (partial patch)
Workstation 12.x – Upgrade to 12.5.8
Fusion 8.x – Updated to 8.5.9

When to PATCH – Immediately

If you have SQL Server 2017 or SQL Server 2016 running, then patches are available.

SQL Server (Windows) VM in your data center – Patch host OS or isolate SQL Server back on physical hardware. Check Windows OS for microcode changes.

SQL Server (Windows) on bare metal or VM, not isolated from application code on the same machine, or using untrusted code – Apply OS patches, SQL Server patches, enable microcode changes.

SQL Server Linux – Apply Linux OS patches, Linux SQL Server patches, check with Linux vendor

Note that when untrusted SQL Server extensibility mechanisms are mentioned, they mean:

SQL CLR
R and Python packages running through sp_external_script, or standalone R/ML Learning Studio on a machine
SQL Agent running ActiveX scripts
Non-MS OLEDB providers in linked servers
Non-MS XPs

There are mitigations in the SQL Server KB.

When You Can Patch Later

If you have SQL Server 2008, 2008 R2, 2012, 2014 you’ll have to wait on SQL Server patches. They aren’t out yet. However, there are other situations that remove an immediate need for patching.

When You Don’t Need to Patch
If you are on AWS, they’ve patched their systems, except for EC2 VMS. Those need patches from you. AWS Statement

Azure is patched according to KB4073235. Guidance in ADV180002 says .This does not include VMs that don’t get automatic updates. You need to patch those manually.

Apple – If you’re running High Sierra, Sierra, or El Capitan, it looks like Apple took care of this back in December of 2017.

Browsers

Chrome – It looks like Google is going to release a patch for Chrome later in January. See this link for more information.
Firefox – Version 57 or later has the proper fixes. See this blog for more information, so patch away!
Edge and Internet Explorer – Microsoft has a blog post . It looks like the January security update (KB4056890) takes care of that. So if you’re using either of these browsers, please update your OSes as soon as possible.

Details On the Exploits

Descriptions of the exploit, if you want to dig down and understand.

https://meltdownattack.com/

The Register
Ars Technia
cyber.wtf researcher blog

SQL Server 2014 SP2 CU9

January 2nd, 2018

On December 18, 2017, Microsoft released SQL Server 2014 SP2 CU9, which is Build 12.05563.0.
This CU has seven public hotfixes, most of which are for the SQL Engine of SQL performance -critical for taks like mrp. inventory close, consolidation etc.

Since SQL Server 2014 SP1 and earlier are no longer “supported service packs”, there is no corresponding CU for the SP1 or RTM branches of SQL Server 2014.

As always, make an effort to stay current on cumulative updates