You need both SQL and Windows patches, as well as CPU microcode updates, to be fully** protected.
GDR is meant to be security-only patches, whereas Cumulative Updates are bug fixes as well as security patches. Once you go from the GDR path on to the CU path, you're stuck there, i.e. you can't go back to GDR only.
(Confusingly, this latest Meltdown / Spectre update shows up on certain SQL Server versions as a GDR and CU update.)
If you are already on a CU, then stick with CU update.
** Note that Microsoft is rolling back the Meltdown / Spectre updates on Windows Update because there are some issues with certain CPUs, so it's hard to tell whether you were one of the lucky ones to get them while they were up. See the warning below.
Use this link to check if you're fully patched, using a PowerShell script from Microsoft.
The link includes the following statement:
Customers must take the following actions to help protect against the
- Verify that you are running a supported antivirus application before
you install operating system or firmware updates. Contact the
antivirus software vendor for compatibility information.
- Apply all
available Windows operating system updates, including the January 2018
Windows security updates.
- Apply the applicable firmware update that is
provided by the device manufacturer.
And this warning:
Customers who only install the Windows January 2018 security updates will not receive the benefit of all known protections against the vulnerabilities. In addition to installing the January security updates, a processor microcode, or firmware, update is required. This should be available through your device manufacturer.