What is the security problem called Meltdown and Specter? Can it be corrected at the software level?

These are actually two security flaws discovered recently (at the end of 2017).

What does it consist of?

There is already a well-documented reference page, called meltdownattack.com. There it is simply explained what the error consists of:

Meltdown and Specter exploit critical vulnerabilities in modern processors. These hardware errors allow programs to steal data that is currently being processed by the computer . While programs are not normally allowed to read data from other programs, a malicious program can exploit Meltdown and Specter to obtain secrets stored in the memory of other running programs . This could include your passwords stored in a password manager or browser, your personal photos, emails, instant messages, and even business-critical documents .

Meltdown and Specter work on personal computers, mobile devices, and in the cloud. Depending on the cloud provider's infrastructure, it might be possible to steal data from other customers.

As said before, there are two different types of attacks:

melt down

Meltdown breaks the most fundamental isolation between user applications and the operating system. This attack allows a program to access memory and thus also the secrets of other programs and the operating system.

If your computer has a vulnerable processor and is running an unpatched operating system, it is not safe to work with sensitive information without the ability to leak the information. This applies to both personal computers and cloud infrastructure. Fortunately, there are software patches against Meltdown .

What systems are affected by Meltdown?

Desktops, laptops, and cloud computers can be affected by Meltdown. More technically, every Intel processor that implements execution out of order can potentially be affected, meaning every processor since 1995 (except pre-2013 Intel Itanium and Intel Atom).

Meltdown has been successfully tested on Intel processor generations released as early as 2011. Currently, Meltdown has only been verified on Intel processors. At the moment, it is not clear if ARM and AMD processors are also affected by Meltdown.

Which cloud providers are affected by Meltdown?

Cloud providers using Intel and Xen PV CPUs with unpatched virtualization. Also, cloud providers without real hardware virtualization, which rely on containers that share a kernel, such as Docker, LXC or OpenVZ are affected.

Specter

Specter breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the security controls in such best practices actually increase the attack surface and can make applications more susceptible to Specter.

Specter is harder to exploit than Meltdown , but it's also harder to mitigate. However, it is possible to prevent specific known Spectre-based exploits through software patches .

What systems are affected by Spectre?

Specter affects almost all systems: desktops, laptops, cloud servers, and smartphones.

More specifically, all modern processors capable of holding many instructions in flight are potentially vulnerable. In particular, we have tested Specter on Intel, AMD and ARM processors.

According to Google, both bugs can affect all computers with processors dating back to 1995.

Not only Intel processors would be involved, but also others such as AMD, but to a lesser degree.

It is said that the security patches may affect the performance of the equipment (between 5 and 30% according to reports).

See here for more details on these claims.

Can the error be corrected at the software level?

The error must be corrected at the software level, applying security patches: at the operating system level and at the browser level (since the problem could affect our sensitive content in the cloud).

There meltdownattack.comis a section on the page that compiles the links to security notices and patches published by the main software companies.

According to PCWorld :

Patches already exist for Windows, Mac, and Chromebook users.

Microsoft released a Windows update that protects against Meltdown on January 3. Updates released outside of Microsoft's monthly "Patch Tuesdays" are rare, underscoring the seriousness of this issue.

Apple has quietly protected against Meltdown in macOS High Sierra 10.13.2, which was released on December 6, according to developer Alex Ionescu . Who says additional safeguards will be found in macOS 10.13.3.

For Linux also there are already kernel patches.

Chromebooks received protection in Chrome OS 63, which was released on December 15 . Additionally, the Chrome web browser has been updated to include an optional experimental feature called "site isolation" that can help protect against Meltdown and Specter attacks . Site isolation is more complicated on mobile devices; Google warns that it can create "functionality and performance issues" on Android, and since Chrome on iOS is forced to use Apple's WKWebView, protections for Specter on that platform must come from Apple. Chrome 64 will include more mitigations.

Mozilla and Microsoft are also taking steps to protect browsers against Spectre. Firefox 57 launched in November with some initial reassurances, and Edge and Internet Explorer received an update along with Windows 10.

Links

• meltdownattack.com - This site explains what the attack is about, and compiles links to official advisories from major IT players about the problem.
• Intel statement on Meltdown and Specter