Svchost.exe 100% CPU bug still not fixed

Few bugs are as long standing as the svchost.exe Windows Update bug on Windows XP. Some sources have reported that the bug, in which the svchost.exe process suddenly takes up 100 percent of the CPU, has been known at least as far back as 2004.

Now, as the sun finally sets on the 12-year-old operating system, it looks like Microsoft will patch in a fix just in time for updates to end in April.

According to the patch management mailing list, the bug is caused by the “Windows Update Agent processing long lists of superseded updates.” As these lists have gotten longer over the life of Windows XP, the processing cost increased exponentially.

The solution, it seemed, was to shorten the lists:

"As a result, we took what we believed were the right steps to expire large chunks of superseded (outdated, unnecessary) updates in the IE6 and IE7 supersedence lists. Testing suggested this would be sufficient and we made the change on the backend in a release in October that expired these many unnecessary updates. Turns out the Windows Update Agent has smarts built into it that outsmarted us and the problem persisted for the majority of impacted customers. We made a more comprehensive change in November and an even larger set of logic and expiration changes in December. Unfortunately, the problem still wasn't solved."

For users who experience this bug, the real world effects can often vary widely depending on the specific hardware configuration. When testing on Windows XP it is important to keep in mind that this bug can occur and how it can alter the software and/or hardware under test’s interaction with the CPU. Since processes can take significantly longer to complete this can introduce a wide variety of unexpected issues, including memory leaks and race conditions. This is most important when doing transaction flow testing, when you want to mimic an average user’s behavior as closely as possible.

The continuing appearance of this bug is also a good example of when it’s important to use rigorous transaction flow testing. As stated above, the Windows Update said they tested the update and thought they had the bug fixed; however, when released into the wild, the defect remained. This implies the testing did not follow closely enough to scenarios that more closely match an average user’s experience. It’s possible such testing would have caught the non-fix and helped the developers figure out another fix before updates end in April.

So, it’s back to the drawing board for the Windows Update team. While there isn’t any information on another possible fix or an ETA for when it might come out, the whole issue may be moot come April, as pointed out by ArsTechnica: “At this point, Windows XP users will be able to solve the problem for themselves anyway: they can simply turn off Windows Update forever, since it will no longer update their systems anyway.”

Source: Patch Management Mailing List via ArsTechnica