Yesterday, Microsoft reported that Windows users will receive the microcode updates released by Intel to patch the Spectre flaw.
Thanks to the Meltdown and Spectre attacks, the malicious applications can bypass memory isolation and access all users’ sensitive data.
Most probably, the Meltdown attacks are due to a vulnerability tracked as CVE-2017-5754, and the Spectre attacks are a combination of CVE-2017-5753 (Variant 1) and CVE-2017-5715 (Variant 2).
Meltdown and Spectre Variant 1 can be addressed with software updates, however, Spectre Variant 2 requires microcode patches.
The Microsoft Corporation has provided Windows users the software updates and has already started delivering the microcode patches.
As the first Spectre microcode patches from Intel caused more frequent reboots and other instability problems, the company started releasing new updates. The first patches were for Skylake, then for Kaby Lake and Coffee Lake, and the latest patch was for Haswell and Broadwell processors.
After being tested, the microcode updates for device manufacturers should be available to other customers as well.
In the meantime, Microsoft will deliver Intel’s microcode updates to devices with 6th Generation Intel Core (Skylake) processors if they are running Windows 10 version 1709 (Fall Creators Update) or Windows Server version 1709 (Server Core).
“We will offer additional microcode updates from Intel as they become available to Microsoft. We will continue to work with chipset and device makers as they offer more vulnerability mitigations,” John Cable, director of Program Management, Windows Servicing and Delivery, stated.
When they started releasing the software mitigations for Spectre and Meltdown, Microsoft warned that due to antivirus compatibility issues, some users may not receive the updates.
According to John Cable, most of the Windows devices already have compatible security products installed, so they should not experience any problems in getting the patches.
“We will continue to require that an AV compatibility check is made before delivering the latest Windows security updates via Windows Update until we have a sufficient level of AV software compatibility,” Cable said.
As Intel’s first round of microcode updates caused instability issues, Microsoft released an update which let Windows users disable the Spectre Variant 2 mitigation.
