Microsoft pushing out emergency fix for newly disclosed processor exploit

Updated 7PM ET: Microsoft is now pushing out KB4056892 (OS Build 16299.192) as the official fix.

Following up on the disclosure of exploits that affect Intel, AMD, and ARM processors, Microsoft is rolling out an emergency update for Windows users. In a statement to The Verge, Microsoft also confirmed that it is deploying fixes to its cloud services.

From Microsoft:

We're aware of this industry-wide issue and have been working closely with chip manufacturers to develop and test mitigations to protect our customers. We are in the process of deploying mitigations to cloud services and have also released security updates to protect Windows customers against vulnerabilities affecting supported hardware chips from Intel, ARM, and AMD. We have not received any information to indicate that these vulnerabilities had been used to attack our customers.

According to The Verge, Windows 10 users will be automatically updated with the patch today through Windows Update. And while the patch will be available from Microsoft for Windows 7 and 8 users today, they will have to wait until Patch Tuesday to receive it automatically via Windows Update.

The changelog for KB4056892 includes:

• Addresses issue where event logs stop receiving events when a maximum file size policy is applied to the channel.
• Addresses issue where printing an Office Online document in Microsoft Edge fails.
• Addresses issue where the touch keyboard doesn't support the standard layout for 109 keyboards.
• Addresses video playback issues in applications such as Microsoft Edge that affect some devices when playing back video on a monitor and a secondary, duplicated display.
• Addresses issue where Microsoft Edge stops responding for up to 3 seconds while displaying content from a software rendering path.
• Addresses issue where only 4 TB of memory is shown as available in Task Manager in Windows Server version 1709 when more memory is actually installed, configured, and available.
• Security updates to Windows SMB Server, the Windows Subsystem for Linux, Windows Kernel, Windows Datacenter Networking, Windows Graphics, Microsoft Edge, Internet Explorer, and the Microsoft Scripting Engine.

The update follows a whirlwind of developments, starting with initial reports that Intel processors were impacted by a new security vulnerability. Researchers later disclosed virtually all modern processors are affected by two new exploits, dubbed Meltdown and Spectre, that can act as vectors for attackers to access things like passwords, photos, emails, and other sensitive information.

Meltdown is the easier to exploit of the two, according to researchers, and only appears to impact Intel processors. Patches for Meltdown are also already available, including those for Linux, macOS, and today's Windows update. Spectre, on the other hand, impacts a much wider array of processors, including those from Intel, AMD, and ARM. While it's more difficult to exploit, it is also much harder to fix.

Microsoft is also noting what could be a fairly severe "known issue" with this release, which is likely due to the rushed nature of the situation.

Update installation may stop at 99% and may show elevated CPU or disk utilization if a device was reset using the Reset this PC functionality after installing KB4054022.

Microsoft provides instructions on how to fix this situation if it should occur.