Number: AV18-071
Date: 27 April 2018
Purpose
The purpose of this advisory is to bring attention to recently released Microsoft updates in regards to mitigation towards Spectre Variant 2.
Assessment
Two updates have been released by Microsoft in regards to mitigation towards the Spectre Variant 2 “Branch Target Injection” vulnerability. KB4078407 is software-based OS-level mitigation, whereas KB4091666 is for Intel processors only and includes Intel microcode updates needed to mitigate at the hardware level.
Affected Products:
- Windows 10 version 1709
- Windows Server 2016 Version 1709
- Windows 10 Version 1703
- Windows 10 Version 1607
- Windows Server 2016
- Windows Server 2016 Datacenter
- Windows Server 2016 Essentials
- Windows Server 2016 Standard
- Windows 10 with Intel CPU
CVE References: CVE-2017-5715
Suggested Action
CCIRC recommends that system administrators test and deploy the vendor-released updates to affected applications accordingly.
References: