Newsletter Archives

• Microsoft offers more Spectre v2 microcode updates, KB 4090007, KB 4091663, KB 4091664

  Posted on April 26, 2018 at 09:42 CDT by woody • Comment in the Forums

  Yesterday, I posted a note about two new Spectre v2 patches, KB 4078407 and KB 4091666.

  The first is a Win10-only fix that has to be combined with a microcode change from your hardware manufacturer in order to accomplish anything. As @abbodi86 notes:

  KB4078407 is not a patch, it’s just an executable that enables the Spectre mitigation protection by changing two registry entries

  The second is a microcode-only, Intel-only, Win10 1507-only patch that changes the microcode for a large number of Intel processors.

  This morning, Günter Born notes on Borncity that there are now four of these microcode patches:

  • KB4090007 for Win10 1709/”Server 2016 version 1709″
  • KB4091663 for Win10 1703
  • KB4091664 for Win10 1607/Server 2016

  In addition to the one I described yesterday, KB4091666 for Win10 1507.

  None of them are available through Windows Update. You have to manually dig into the Update Catalog to get them.

  As noted (voluminously) there are no known exploits as yet for Meltdown, Spectre v1 or Spectre v2. You might want to tuck these away in case we ever see a reason to use them.

  Windows Patches/Security KB 4078407, KB 4090007, KB 4091663, KB 4091664, Meltdown, Spectre

• So tell me again what’s happening with the two new Spectre v2 patches, KB 4078407 and KB 4091666

  Posted on April 25, 2018 at 11:33 CDT by woody • Comment in the Forums

  Yesterday, Microsoft released two patches that tackle the Spectre v2 vulnerability — the one that’s never been seen in public.

  The first patch, KB 4078407, is a Windows 10-only fix that has to be combined with a microcode change from your hardware manufacturer in order to be effective.

  The second patch, KB 4091666, is a microcode-only, Intel-only, Win10 1507-only patch that covers a lengthy list of affected Intel processors. The KB article says:

  This update is a standalone update available through the Microsoft Update Catalog and targeted for Windows 10 Release To Market (RTM). This update also includes Intel microcode updates that were already released for these Operating Systems at the time of Release To Manufacturing (RTM). We will offer additional microcode updates from Intel thru this KB Article for these Operating Systems as they become available to Microsoft.

  … which is as muddled a bunch of gobbledygook as I’ve ever seen in a KB article. If you can parse it, tell me. All I know for sure is that the Microsoft Update Catalog entry tells me that the patch is only for Win10 1507.

  You may recall that Microsoft released KB 4090007 back in March. It was intended to provide Intel-offered microcode patches to Win10 1709 machines for 6th gen Skylake processors, but it mutated several times — to the point that I don’t know what it does now.

  Of course, there’s no advice about the obvious overlap between KB 4090007 and KB 4091666.

  Sigh.

  Windows Patches/Security KB 4078407, KB 4090007, KB 4091666