Sql-server – Recent patches for vulnerability attacks for SQL Server 2014 SP2 version

patchingservice-packsql serversql server 2014

Keeping in mind the recent vulnerability attacks patches like Spectre and Meltdown , I would like to patch my SQL Server 2014 SP2 (12.0.5000)

1.Description of the security update for SQL Server 2014 SP2 CU10: January 16, 2018 – SP2 CU10 KB4057117 12.0.5571.0
2.Description of the security update for SQL Server 2014 SP2 GDR: January 16, 2018 – SP2 GDR KB4057120 12.0.5214.6

Can anyone help me for below questions:

  1. Recently we patched our Windows 2012 R2 Standard servers . Is OS Patching different from SQL Sever patching or these patches are already included during monthly OS patching installed ?
  2. Since we have both CU10 and GDR , should I apply both ?
  3. Which one should I need to first apply GDR or CU 10 ?

Best Answer

You need both SQL and Windows patches, as well as CPU microcode updates, to be fully** protected.

GDR is meant to be security-only patches, whereas Cumulative Updates are bug fixes as well as security patches. Once you go from the GDR path on to the CU path, you're stuck there, i.e. you can't go back to GDR only.

(Confusingly, this latest Meltdown / Spectre update shows up on certain SQL Server versions as a GDR and CU update.)

If you are already on a CU, then stick with CU update.

** Note that Microsoft is rolling back the Meltdown / Spectre updates on Windows Update because there are some issues with certain CPUs, so it's hard to tell whether you were one of the lucky ones to get them while they were up. See the warning below.

Use this link to check if you're fully patched, using a PowerShell script from Microsoft.

The link includes the following statement:

Customers must take the following actions to help protect against the vulnerabilities:

  • Verify that you are running a supported antivirus application before you install operating system or firmware updates. Contact the antivirus software vendor for compatibility information.
  • Apply all available Windows operating system updates, including the January 2018 Windows security updates.
  • Apply the applicable firmware update that is provided by the device manufacturer.

And this warning:

Customers who only install the Windows January 2018 security updates will not receive the benefit of all known protections against the vulnerabilities. In addition to installing the January security updates, a processor microcode, or firmware, update is required. This should be available through your device manufacturer.

Related Question