Meltdown and Spectre — the two critical vulnerabilities affecting every modern processor produced in the last 20 years. The vulnerabilities were discovered by Google last year but only disclosed recently to the public.
According to early reports, the vulnerabilities exploits fundamental design and functioning of processors and operating system kernel to stole users data. Modern processors like Intel, AMD, & ARM, all are vulnerable to Meltdown and Spectre thus makes devices powered by operating system Linux, macOS, Windows & Android also vulnerable.
Today in this article, we are going to brief these two critical vulnerabilities and explains how attackers utilize it to compromise your system.
Meltdown and Spectre: Affects both existing and upcoming CPU’s security
Meltdown and Spectre are the same family of vulnerability but affects the system by exploiting two fundamental performance functionality of the processors. Usually, programs installed on our devices are not permitted to read data from other programs but these hardware bugs allow a malicious program to get hold of secrets stored in the memory of other running programs.
Meltdown is a novel attack that allows overcoming memory isolation functionality of the computer system by exploiting Out-of-order Execution feature of processors where Spectre exploits Speculative Execution feature of modern procesors. Let’s dive into more details.
Meltdown: Exploits out-of-order execution feature
As we already said, Meltdown CPU vulnerability exploits on out-of-order execution feature of processors to bypass memory isolation of operating system. Memory isolation is one of the central security features of today’s operating systems.
In general, memory isolation is the hardware and software methods for the prevention of the writing or reading of information at an unauthorized address in the memory of a computer. Like, the kernel has the highest level of security privileges in a system are marked as non-accessible and are protected from user access. But Meltdown vulnerability allows a malicious program to access this restricted memory locations.
Meltdown exploits side effects of “out-of-order execution” on modern processors to read arbitrary kernel-memory locations including personal data and passwords. Out-of-order execution is a vital performance feature of modern processors to overcome latencies of busy execution units. Meltdown does not exploit any software vulnerability and the attack is independent of the operating system. So all major operating systems are vulnerable. And vulnerability CVE-2017-5754 has been assigned to Meltdown.
Devices affected by Meltdown:
Desktop, laptop, and cloud computers may be affected by Meltdown. Mainly, every Intel processor which implements out-of-order execution feature is potentially affected. This includes every processor since 1995 and also all upcoming Intel processors too. Also, Cloud providers which use Intel CPUs and Xen PV as virtualization without having patches applied are also affected by this CPU vulnerability. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.
Spectre: Exploits speculative execution feature
Unlike Meltdown, Spectre exploits on speculative execution — which is an optimization technique used by all modern processors to maximize performance by guessing likely future execution paths and prematurely executing the instructions in them.
And with Spectre CPU vulnerability, the attacker tricks other applications into accessing unauthorized locations speculatively perform operations that would not occur during correct program execution. So Spectre is not easy to fix as compared to Meltdown vulnerability. Also, vulnerability CVE-2017-5753 and CVE-2017-5715 are the official references to Spectre.
Devices affected by Spectre:
The processors started to use speculative execution feature from 15 and 20 years ago, so almost all CPU made in the last 20 years or so is vulnerable. Desktops, laptops, cloud servers, as well as smartphones, all are affected by Spectre. Processors verified with Spectre vulnerabilities are Intel, AMD, and ARM.
So both Meltdown and Spectre vulnerability work on personal computers, mobile devices, and in the cloud, so literally no one safe from this massive security flaw. Also, they use side channels to obtain the information from the accessed memory location. And
Fix for Meltdown and Spectre:
Since both Meltdown and Spectre vulnerabilities rely on the performance side of the processors — so according to experts the fix for this CPU flaws going to reduce the performance of the system by 30 percent. Also, all impacted parties are working to release patches in upcoming weeks. Windows, Linux, Intel, and others already pushed patches and are working further for more updates.
More details of Meltdown and Spectre flaws including draft papers on this page.
