• So tell me again what’s happening with the two new Spectre v2 patches, KB 4078407 and KB 4091666

    Yesterday, Microsoft released two patches that tackle the Spectre v2 vulnerability — the one that’s never been seen in public.

    The first patch, KB 4078407, is a Windows 10-only fix that has to be combined with a microcode change from your hardware manufacturer in order to be effective.

    The second patch, KB 4091666, is a microcode-only, Intel-only, Win10 1507-only patch that covers a lengthy list of affected Intel processors. The KB article says:

    This update is a standalone update available through the Microsoft Update Catalog and targeted for Windows 10 Release To Market (RTM). This update also includes Intel microcode updates that were already released for these Operating Systems at the time of Release To Manufacturing (RTM). We will offer additional microcode updates from Intel thru this KB Article for these Operating Systems as they become available to Microsoft.

    … which is as muddled a bunch of gobbledygook as I’ve ever seen in a KB article. If you can parse it, tell me. All I know for sure is that the Microsoft Update Catalog entry tells me that the patch is only for Win10 1507.

    You may recall that Microsoft released KB 4090007 back in March. It was intended to provide Intel-offered microcode patches to Win10 1709 machines for 6th gen Skylake processors, but it mutated several times — to the point that I don’t know what it does now.

    Of course, there’s no advice about the obvious overlap between KB 4090007 and KB 4091666.

    Sigh.