KB4100347 Intel microcode updates for Windows 10 v1803 - January 8 Win Update

From https://meltdownattack.com Q&A

Has Meltdown or Spectre been abused in the wild?

We don't know.

What does the question mean?

andyouf said:

The fact that the protection can be enabled and disabled. So I guess CPU firmware can be altered on the fly with a utility or did Intel build the ability to enable/disable protection into the code? Or is it done through the BIOS?

Combination of uCode and registry settings.

The uCode is loaded at hardware initialisation via UEFI or boot-patched into kernel via .dll (which is what is updated by the WU).

The registry allows you to turn the protection on or off on the fly, but not the uCode.

andyouf said:

From https://meltdownattack.com Q&A

What does the question mean?

Has this exploit been successfully exploited?

Answer: With current techniques it is impossible to tell. Spectre is well-named; as well as being named after Speculative Execution, it is a ghost as perfectly legal (and by that I mean non-viral) code is used to 'snoop' across memory boundaries or into other processes. This code can be program code or most likely Javascript; stuff like 'Site Isolation' and 'Kernel Page Table Isolation' give you some idea of the methods used to mitigate. Instructions like LFENCE, programming techniques such as 'retpoline' (portmanteau of return & trampoline) and 'timer-fuzzing' also give an idea of what is occuring.

Another analogy is basically a man reading a newspaper and he sees you reading over his shoulder so he lifts the adjacent page to stop you seeing what he's reading. Basically you know he's reading pages 4 & 5 by the fact you get to read page 3 for free as long as he tries to shield it from you. When he leaves his seat and discards the paper on the seat or in the trash, you get the gold / dirt on pages 4 & 5.

Oh okay I didn't get the term at all. I read up on speculative execution, still don't quite get how it works but it seems great (except for the vulnerability part). The newspaper analogy I'm guessing is saying that content I viewed is discarded to memory to be viewed by a malicious user.

I got this update this morning after manually running a Windows Update check. WU ran an auto check earlier today and it wasn't there. A lot of people don't manually check WU for updates and will be missing this. One would think MS would make sure something this important would show up automatically.