Meltdown and Spectre are two new *potential* security vulnerabilities that effect most people using computers, and they're at the center of controversy that's likely to last for years. The main reason for the controversy is that the proposed fixes cost CPU performance -- we won't know for sure how much until those fixes have been widely deployed, but initial testing shows up to around 50%. Because there's several lawsuits coming, much [most?] of what you read today will include some amount of hype. A good source for links to info is:
bleepingcomputer[.]com/news/security/list-of-meltdown-and-spectre-vulnerability-advisories-patches-and-updates/
Windows users will get the Microsoft patch on Update Tuesday, depending on your security software. It's being pushed out to Windows 10 [& *possibly* to 8] since last Thursday -- the patch's release was pushed up because of press leaks -- depending on installed security software. Security software can make undocumented calls to Windows kernel that, after applying this patch can cause BSODs, so Microsoft has instructed security software companies to add a special flag to the registry when their installed software is compliant -- Windows Update will not push this patch if it does not see this key. [Preventing this key, maybe through a task &/or script, *might* be a way to avoid having this patch installed.]
-----
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat]
"cadca5fe-87d3-4b96-b7fb-a231484277cc"=dword:00000000
-----
The update itself is available for Windows 10 at: catalog[.]update[.]microsoft[.]com/Search.aspx?q=kb4056892 . I assume it'll be available for other Windows versions next Tuesday or Wednesday. AMD CPUs are less effected than Intel's -- AMD has requested that any patches take this into account, and don't rob the same level of performance as with Intel CPUs, but AFAIK it's unknown whether or not Microsoft has complied with their request.
Newer Intel CPUs are said to suffer less performance loss from the fixes -- I've read starting with CPUs released in both 2014 & 2015, so we'll probably have to wait for post-patch testing to know which CPUs suffer most. Intel has pushed out firmware patches, but realistically that doesn't matter unless you have a new device, since they have to be incorporated into firmware & released by hardware manufacturers, which won't happen with most hardware. The amount of performance lost depends on what you're doing -- some programs & operations are effected much more than others -- but again we'll wind up waiting for post-patch testing to be sure where the biggest hits lie.
A small bit more on what it is...
Making money fixing problems you yourself caused is an ancient scam. You can cross a fine line however, and do the same thing legally, by establishing a threat that has nothing to do with you or any actions that you might take. Few have mastered this better than many [most?] involved in computer-related security, where researchers effectively act as the R&D branch of cyber crime & spying. The basic idea they present is that if they can figure out a way to do something, so can cyber criminals, so you need to pay them to always stay a step ahead. The question few ask these folks however, is: "What makes you think that cyber criminals will in fact do as you say?" That's the weak point behind their argument, and one they're well aware of, so they take it a step further, producing tutorials & programs for cyber criminals to use, saying "Told ya" when that stuff's used as they intended.
I believe that it was this mindset that led to the original idea around July, 2017, that it *might* be possible to access protected data from the CPU's memory cache, but the person alleged to have thought this up 1st couldn't get it to actually work. Building on what that person published, and with the same mindset, a Google researcher(s) came up with proof-of-concept code using a very limited set of CPUs & OSes, giving that info to Intel, Microsoft etc. This all was kept Very silent for the remainder of 2017, as Microsoft etc. worked on fixes, and Intel's CEO sold all the Intel stock he could. Microsoft trialed their patch with Insider builds of 10, planning to release patches for all supported Windows version 1/9/2018, when news of all this was published by the Register last week.
Everything I've read says that no one has seen anything actually using these vulnerabilities, though at the same time detecting it would be extremely difficult. To take advantage of these vulnerabilities you need local access -- IOW Windows [or whatever OS, since all are effected] would have to already be compromised. And AFAIK, as it stands, no one has addressed publicly why anyone would want to use what really is [at this point] a very complicated method to achieve what they can already get now, once they've already compromised a Windows system. Theoretically it might make exploiting a VM more attractive, as a means of breaking out of that VM to access other VMs on the same host, with Microsoft & Amazon patching their cloud services last week accordingly -- to Many customer complaints it appears, with big slowdowns reported.
Personally I wonder why individual Windows users are being made to suffer when, again AFAIK, no one's made that case as to why a cyber criminal would use an exploit taking advantage of these vulnerabilities in the first place, when most are doing just fine with current, easier, simpler scams. This is of course pending security researchers developing better methods & code for their *clients (?)*. There *may* be a way to exploit these vulnerabilities with JavaScript, so changes are coming to all brands of browsers, but hopefully that'll carry much less of a penalty than the Windows patching.
