Microsoft releases additional security updates for Spectre vulnerability.
Microsoft released more Windows 10 updates for the Spectre side-channel flaw found in January, with an expanded lineup of firmware updates for Intel CPUs that include the Broadwell and Haswell chipsets. Microsoft released two Windows Update packages for Spectre, KB4091666, which contains the Intel microcode update and KB4078407, both available as manual downloads from the Microsoft Update Catalog portal. The latest releases came after Microsoft's initial release of Intel CPU microcode fixes in March, KB4090007, which addressed some Skylake devices running the most commonly installed version of Windows 10. With these additional updates, the firmware lineup now covers most Skylake, Haswell and Broadwell chips.
Microsoft's decision to help distribute available Intel firmware through Windows updates adds another layer of security for Intel based processors on top of Intel's reliance on motherboard and system vendors to package the microcode into BIOS updates for products. Windows devices needs both software and firmware updates to help protect them against these new vulnerabilities. Intel announced that they completed their validations and started to release microcode for newer CPU platforms. Earlier in April, Microsoft released operating system updates addressing Spectre for AMD in its updates. These Spectre patches are for AMD users running Windows 10, version 1709.
The Spectre and Meltdown security flaws were first publicized by Google Project Zero in early January. The vulnerability affect a range of processors, Intel, ARM and AMD. The vulnerabilities potentially allows hackers to access users' protected data. In the months since they were publicized, both software and hardware companies have been rushing to figure out the best strategies for issuing patches around the security flaws. Intel and Microsoft had some problems along the way. One instance, Microsoft's January Patch, allegedly made the security issues worse. Intel, in January acknowledged that some companies were reporting reboot issues with both older and newer chips, for both client compute and data center environments, after they patched their devices.