text:
Meltdown (security vulnerability)
From Wikipedia, the free encyclopedia
Jump to: navigation, search
The logo used by the team that discovered the vulnerability
Meltdown is a hardware vulnerability affecting Intel x86 microprocessors, IBM POWER processors, and some ARM-based microprocessors.[1][2][3] It allows a rogue process to read all memory, even when it is not authorized to do so.
Meltdown affects a wide range of systems. At the time of disclosure, this included all devices running any but the most recent and patched versions of iOS,[4] Linux,[5][6] macOS,[4] or Windows. Accordingly, many servers and cloud services were impacted,[7] as well as a potential majority of smart devices and embedded devices using ARM based processors (mobile devices, smart TVs and others), including a wide range of networking equipment. A purely software workaround to Meltdown has been assessed as slowing computers between 5 and 30 percent in certain specialized workloads,[8] although companies responsible for software correction of the exploit are reporting minimal impact from general benchmark testing.[9]
Meltdown was issued a Common Vulnerabilities and Exposures ID of CVE-2017-5754, also known as Rogue Data Cache Load,[2] in January 2018. It was disclosed in conjunction with another exploit, Spectre, with which it shares some, but not all characteristics. The Meltdown and Spectre vulnerabilities are considered "catastrophic" by security analysts.[10][11][12] The vulnerabilities are so severe that, initially, security researchers believed them to be false.[13]
Several procedures to help protect home computers and related devices from the Meltdown and Spectre security vulnerabilities have been published.[14][15][16][17] Meltdown patches may produce performance loss.[18][19][20] Spectre patches have been reported to significantly reduce performance, especially on older computers; on the newer eighth-generation Core platforms, benchmark performance drops of 2–14 percent have been measured.[21] On January 18, 2018, unwanted reboots, even for newer Intel chips, due to Meltdown and Spectre patches, were reported.[22] Nonetheless, according to Dell computers: "No 'real-world' exploits of these vulnerabilities [ie, Meltdown and Spectre] have been reported to date [January 26, 2018], though researchers have produced proof-of-concepts."[23][24] Further, recommended preventions include: "promptly adopting software updates, avoiding unrecognized hyperlinks and websites, not downloading files or applications from unknown sources ... following secure password protocols ... [using] security software to help protect against malware (advanced threat prevention software or anti-virus)."[23][24]
On January 25, 2018, the current status and possible future considerations in solving the Meltdown and Spectre vulnerabilities were presented.[25]
Contents
[hide]
1 Overview
2 History
3 Affected hardware
4 Mechanism
4.1 Background – modern CPU design
4.2 Meltdown exploit
5 Impact
6 Mitigation
7 See also
8 References
9 External links
Overview[edit]
Meltdown exploits a race condition, inherent in the design of many modern CPUs. This occurs between memory access and privilege checking during instruction processing. Additionally, combined with a cache side-channel attack, this vulnerability allows a process to bypass the normal privilege checks that isolate the exploit process from accessing data belonging to the operating system and other running processes. The vulnerability allows an unauthorized process to read data from any address that is mapped to the current process's memory space. Since instruction pipelining is in the affected processors, the data from an unauthorized address will almost always be temporarily loaded into the CPU's cache during out-of-order execution —from which the data can be recovered. This can occur even if the original read instruction fails due to privilege checking, and/or if it never produces a readable result.
Since many operating systems map physical memory, kernel processes, and other running user space processes into the address space of every process, Meltdown effectively makes it possible for a rogue process to read any physical, kernel or other processes' mapped memory—regardless of whether it should be able to do so. Defenses against Meltdown would require avoiding the use of memory mapping in a manner vulnerable to such exploits (i.e. a software-based solution) or avoidance of the underlying race condition (i.e. a modification to the CPUs' microcode and/or execution path).
The vulnerability is viable on any operating system in which privileged data is mapped into virtual memory for unprivileged processes—which includes many present-day operating systems. Meltdown could potentially impact a wider range of computers than presently identified, as there is little to no variation in the microprocessor families used by these computers.
A Meltdown attack cannot be detected if it is carried out.[26][27]
History[edit]
This section is in a list format that may be better presented using prose. You can help by converting this section to prose, if appropriate. Editing help is available. (January 2018)
On May 8, 1995, a paper called "The Intel 80x86 Processor Architecture: Pitfalls for Secure Systems" published at the 1995 IEEE Symposium on Security and Privacy warned against a covert timing channel in the CPU cache and translation lookaside buffer (TLB).[28] This analysis was performed under the auspices of the National Security Agency's Trusted Products Evaluation Program (TPEP).
In July 2012, Apple's XNU kernel (used in macOS, iOS and tvOS, among others) adopted kernel address space layout randomization (KASLR) with the release of OS X Mountain Lion 10.8. In essence, the base of the system, including its kernel extensions (kexts) and memory zones, is randomly relocated during the boot process in an effort to reduce the operating system's vulnerability to attacks.[29]
In March 2014, the Linux kernel adopted KASLR to mitigate address leaks.[30]
On August 8, 2016, Anders Fogh and Daniel Gruss presented "Using Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process" at the Black Hat 2016 conference.[31]
On August 10, 2016, Moritz Lipp et al. of TU Graz published "ARMageddon: Cache Attacks on Mobile Devices" in the proceedings of the 25th USENIX security symposium. Even though focused on ARM, it laid the groundwork for the attack vector.[32]
On December 27, 2016, at 33C3, Clémentine Maurice and Moritz Lipp of TU Graz presented their talk "What could possibly go wrong with <insert x86 instruction here>? Side effects include side-channel attacks and bypassing kernel ASLR" which outlined already what is coming.[33]
On February 1, 2017, the CVE numbers 2017-5715, 2017-5753 and 2017-5754 were assigned to Intel.
On February 27, 2017, Bosman et al. of Vrije Universiteit Amsterdam published their findings how address space layout randomization (ASLR) could be abused on cache-based architectures at the NDSS Symposium.[34]
On March 27, 2017, researchers at Austria's Graz University of Technology developed a proof-of-concept that could grab RSA keys from Intel SGX enclaves running on the same system within five minutes by using certain CPU instructions in lieu of a fine-grained timer to exploit cache DRAM side-channels.[35]
In June 2017, KASLR was found to have a large class of new vulnerabilities.[36] Research at Graz University of Technology showed how to solve these vulnerabilities by preventing all access to unauthorized pages.[37] A presentation on the resulting KAISER technique was submitted for the Black Hat congress in July 2017, but was rejected by the organizers.[38] Nevertheless, this work led to kernel page-table isolation (KPTI, originally known as KAISER) in 2017, which was confirmed to eliminate a large class of security bugs, including the not-yet-discovered Meltdown – a fact confirmed by the Meltdown authors.[39]
In July 2017, research made public on the CyberWTF website by security researcher Anders Fogh outlined the use of a cache timing attack to read kernel space data by observing the results of speculative operations conditioned on data fetched with invalid privileges.[40]
Meltdown was discovered independently by Jann Horn from Google's Project Zero, Werner Haas and Thomas Prescher from Cyberus Technology, as well as Daniel Gruss, Moritz Lipp, Stefan Mangard and Michael Schwarz from Graz University of Technology.[41] The same research teams that discovered Meltdown also discovered a related CPU security vulnerability now called Spectre.
In October 2017, Kernel ASLR support on amd64 was added to NetBSD-current, making NetBSD the first totally open-source BSD system to support kernel address space layout randomization (KASLR).[42] However, the partially open-source[43] Apple Darwin, which forms the foundation of macOS and iOS (among others), is based on FreeBSD; KASLR was added to its XNU kernel in 2012 as noted above.
On November 14, 2017, security researcher Alex Ionescu publicly mentioned changes in the new version of Windows 10 that would cause some speed degradation without explaining the necessity for the changes, just referring to similar changes in Linux.[44]
After affected hardware and software vendors had been made aware of the issue on July 28, 2017,[45] the two vulnerabilities were made public jointly, on January 3, 2018, several days ahead of the coordinated release date of January 9, 2018 as news sites started reporting about commits to the Linux kernel and mails to its mailing list.[8] As a result, patches were not available for some platforms, such as Ubuntu,[46] when the vulnerabilities were disclosed.
On January 28, 2018, Intel was reported to have shared news of the Meltdown and Spectre security vulnerabilities with Chinese technology companies before notifying the U.S. government of the flaws.[47]
The security vulnerability was called Meltdown because "the vulnerability basically melts security boundaries which are normally enforced by the hardware."[26]
Affected hardware[edit]
The Meltdown vulnerability primarily affects Intel microprocessors,[48] but some ARM microprocessors are also affected.[49] The vulnerability does not affect AMD microprocessors.[19][50][51][52] Intel has countered that the flaws affect all processors,[53] but AMD has denied this, saying "we believe AMD processors are not susceptible due to our use of privilege level protections within paging architecture".[54]
Researchers have indicated that the Meltdown vulnerability is exclusive to Intel processors, while the Spectre vulnerability can possibly affect some Intel, AMD, and ARM processors.[55][56][57][58] However, ARM announced that some of their processors were vulnerable to Meltdown.[49] Google has reported that any Intel processor since 1995 with out-of-order execution is potentially vulnerable to the Meltdown vulnerability (this excludes Itanium and pre-2013 Intel Atom CPUs).[59] Intel introduced speculative execution to their processors with Intel's P6 family microarchitecture with the Pentium Pro IA-32 microprocessor in 1995.[60]
ARM has reported that the majority of their processors are not vulnerable, and published a list of the specific processors that are affected. The ARM Cortex-A75 core is affected directly by both Meltdown and Spectre vulnerabilities, and Cortex-R7, Cortex-R8, Cortex-A8, Cortex-A9, Cortex-A15, Cortex-A17, Cortex-A57, Cortex-A72 and Cortex-A73 cores are affected only by the Spectre vulnerability.[49] This contradicts some early statements made about the Meltdown vulnerability as being Intel-only.[61]
A large portion of the current mid-range Android handsets use the Cortex-A53 or Cortex-A55 in an octa-core arrangement and are not affected by either the Meltdown or Spectre vulnerability as they do not perform out-of-order execution. This includes devices with the Qualcomm Snapdragon 630, Snapdragon 626, Snapdragon 625, and all Snapdragon 4xx processors based on A53 or A55 cores.[62] Also, no Raspberry Pi computers are vulnerable to either Meltdown or Spectre.[63]
IBM has also confirmed that its Power CPUs are affected by both CPU attacks.[64] Red Hat has publicly announced in its January 3 advisory that the exploits are also for IBM System Z, Power Architecture, POWER8, and POWER9 systems.[65]
Oracle has stated that V9 based SPARC systems ( T5, M5, M6, S7, M7, M8, M10, M12 processors) are NOT affected by Meltdown, though older SPARC processors that are no longer supported may be impacted.[66]
Mechanism[edit]
Meltdown[39] relies on a CPU race condition that can arise between instruction execution and privilege checking, to read unauthorized memory mapped data in a detectable manner before the privilege check can occur to prevent the data being read. The following provides an overview of the exploit, and the memory mapping that is its target. The attack is described in terms of an Intel processor running Microsoft Windows or Linux, the main test targets used in the original paper, but it also affects other processors and operating systems.
Background – modern CPU design[edit]
Modern computer processors use a variety of techniques to gain high levels of efficiency. Four widely used features are particularly relevant to Meltdown:
Virtual (paged) memory, also known as memory mapping – used to make memory access more efficient and to control which processes can access which areas of memory.
A modern computer usually runs many processes in parallel. In an operating system such as Windows or Linux, each process is given the impression that it alone has complete use of the computer's physical memory, and may do with it as it likes. In reality it will be allocated memory to use from the physical memory, which acts as a "pool" of available memory, when it first tries to use any given memory address (by trying to read or write to it). This allows multiple processes, including the kernel or operating system itself, to co-habit on the same system, but retain their individual activity and integrity without being affected by other running processes, and without being vulnerable to interference or unauthorized data leaks caused by a rogue process.
Privilege levels, or protection domains – provide a means by which the operating system can control which processes are authorized to read which areas of virtual memory.
As virtual memory permits a computer to refer to vastly more memory than it will ever physically contain, the system can be greatly sped up by "mapping" every process and their in-use memory – in effect all memory of all active processes – into every process's virtual memory. In some systems all physical memory is mapped as well, for further speed and efficiency. This is usually considered safe, because the operating system can rely on privilege controls built into the processor itself, to limit which areas of memory any given process is permitted to access. An attempt to access authorized memory will immediately succeed, and an attempt to access unauthorized memory will cause an exception and void the read instruction, which will fail. Either the calling process or the operating system directs what will happen if an attempt is made to read from unauthorized memory – typically it causes an error condition and the process that attempted to execute the read will be terminated. As unauthorized reads are usually not part of normal program execution, it is much faster to use this approach than to pause the process every time it executes some function that requires privileged memory to be accessed, to allow that memory to be mapped into a readable address space.
Instruction pipelining and speculative execution – used to allow instructions to execute in the most efficient manner possible – if necessary allowing them to run out of order or in parallel across various processing units within the CPU – so long as the final outcome is correct.
Modern processors commonly contain numerous separate execution units, and a scheduler that decodes instructions and decides, at the time they are executed, the most efficient way to execute them. This might involve the decision that two instructions can execute at the same time, or even out of order, on different execution units (known as "instruction pipelining"). So long as the correct outcome is still achieved, this maximizes efficiency by keeping all of the processor's execution units in use as much as possible. Some instructions, such as conditional branches, will lead to one of two different outcomes, depending on a condition. For example, if a value is 0, it will take one action, and otherwise will take a different action. In some cases, the CPU may not yet know which branch to take. This may be because a value is uncached. Rather than wait to learn the correct option, the CPU may proceed immediately (speculative execution). If so, it can either guess the correct option (predictive execution) or even take both (eager execution). If it executes the incorrect option, the CPU will attempt to discard all effects of its incorrect guess. (See also: branch predictor)
CPU cache – a modest amount of memory within the CPU used to ensure it can work at high speed, to speed up memory access, and to facilitate "intelligent" execution of instructions in an efficient manner.
From the perspective of a CPU, the computer's physical memory is slow to access. Also the instructions a CPU runs are very often repetitive, or access the same or similar memory numerous times. To maximize efficient use of the CPU's resources, modern CPUs often have a modest amount of very fast on-chip memory, known as "CPU cache". When data is accessed or an instruction is read from physical memory, a copy of that information is routinely saved in the CPU cache at the same time. If the CPU later needs the same instruction or memory contents again, it can obtain it with minimal delay from its own cache rather than waiting for a request related to physical memory to take place.
Meltdown exploit[edit]
Ordinarily, the mechanisms described above are considered secure. They provide the basis for most modern operating systems and processors. Meltdown exploits the way these features interact, to bypass the CPU's fundamental privilege controls and access privileged and sensitive data from the operating system and other processes. To understand Meltdown, we consider the data that is mapped in virtual memory (much of which the process is not supposed to be able to access), and look at how the CPU responds when a process attempts to access unauthorized memory. The process is running on a vulnerable version of Windows, Linux, or MacOS, on a 64 bit processor of a vulnerable type.[39] (This is a very common combination across almost all desktop computers, notebooks, laptops, servers and mobile devices.)
Like every other process and the operating system itself, the rogue process has access to a virtual address space (virtual memory) of billions of gigabytes. Ignoring privilege controls, this space will be used in a way that maximizes efficiency. Most is unallocated – it doesn't have any data whatsoever. Some areas are designated to the rogue process for its own instructions and data. For efficiency, and ignoring privilege controls, this space also contains all the other data being used in all the other processes that are running, including the operating system, and possibly even memory that was used but has not been emptied or addresses that always map directly to the entirety of physical memory. However the fact that all of this data is mapped into each process's memory is ordinarily considered completely safe, because the CPU's privilege controls will prevent its abuse. Any attempt by the rogue process to access any of this other data – and indeed anything except its own authorized memory – will result in an exception (error condition). The request will fail and no data will be provided to the rogue process, preserving security.
If a process were to try reading from unauthorized memory, the read instruction will at first be scheduled and pipelined by the CPU, as with all instructions. As usual, an execution unit will be selected and a memory controller unit will be told to read the contents of memory from the address in the instruction, so that it is ready and quickly available within the CPU, when it's time to execute the rest of the instruction. At some point before the instruction is allowed to produce any output, the privilege check will complete elsewhere. In the case of an unauthorized read, the execution unit will be told that the instruction failed the privilege check. It will discard all data from the instruction, never pass anything to the process, and it will instead abandon that instruction and move to the next one.
In theory, provided the execution unit, memory controller, scheduler and privilege check are fault-free, this is a completely secure approach. Even though the privileged memory was read by the execution unit and memory controller unit initially, the instruction execution was then abandoned midway and the unauthorized part-processed workings were discarded – the outcome was correct. However, as Meltdown shows, it is not as secure as has been believed.
In the early stages of the instruction execution, the CPU's scheduler scheduled two events – a privilege check, and the first steps of executing the instruction. As part of that, while it was waiting for the privilege check to complete, the execution unit started by fetching the data. In the case of the rogue process, the data was from an unauthorized address, but it was still fetched by the memory controller during the initial stage of instruction execution, even if it was then discarded and abandoned when the privilege check completed and failed.
Ordinarily this has no effect and security is enforced, because the read data is never made available in any way, until the privilege check has completed. However even when the instruction fails, the data has already been requested by the execution unit and fetched by the memory controller, in order to be ready to process it, and although the execution unit discards the data upon privilege check failure, the CPU cache was in fact updated as an automatic part of fetching the data from memory, in case the same data might be needed shortly a second time. At this point, Meltdown intervenes:[39]
The CPU cache is not readable by an unauthorized process, because it is internal to the CPU. But by using a cache timing attack (a form of side channel attack), it is possible for a rogue process to determine whether data from a specific address is held within the CPU cache, even if it cannot itself read the actual data from that address. If data from some address has been cached by the CPU then a second instruction to read that address will use the CPU cache for the purpose (fast), if not then the CPU would have to request the data to be read from memory (slower). The rogue process can use this difference in timing to detect which of these took place, and whether the address was already in the CPU cache. Usually this wouldn't be an insurmountable vulnerability on its own, but Meltdown can use it combined with other features of the CPU instruction set to gain full access to all mapped memory...
When an instruction asks for memory to be read, it can specify the address to read from, in many different ways. These include indirect addressing modes – instructions that tell the CPU to read from memory X, use the value stored at X to calculate a second address Y, and the "answer" (or returned value) is the value stored in address Y. Meltdown uses this as part of the basis of a side-channel attack to determine the content of the memory at any given address. Suppose the address at 2000 is not directly readable by the process, but could have any value from 1 to 5, and suppose we ignore privilege checking. One could execute an instruction "Read the value of memory at an address given by (5000 plus the value of memory at address 2000)". If address 2000 contains 1, then the CPU will try to return the value of memory at address 5001; if address 2000 contains 2 it will try to return the value of memory at address 5002, and so on. If we then execute a timing attack, and it shows that the CPU was slower to read from addresses 5001, 5002, 5003 and 5005, but faster for address 5004, then we can conclude that the reason is that it has cached data from address 5004, and that this is because it has recently accessed that address. So we can deduce that address 2000 contained the value "4".
If 2000 is an unauthorized address, then this attempt should fail and the process should learn nothing from it, because of the privilege check.
But the problem – as shown by Meltdown – is that, in order to be efficient, the CPU has already started to prepare itself by accessing the memory locations that may be needed, in parallel with the privilege check. That means, when the privilege check fails and the execution unit (correctly) discards the data and abandons the read instruction, address 2000 has already been read and its contents already used to read address 5004, even if the read was abandoned and the in-progress data was discarded by the CPU's execution unit. Moreover, when the memory controller was told by the execution unit to access address 5004 in preparation for the instruction, it automatically put a copy of that data into the CPU cache as usual, in case of a future request for the same data, and that copy is still present in the CPU cache. (It isn't expected to be detectable without authorization, and will often be needed again quite soon when it's been needed a first time.) So even though the instruction itself failed, and even though the process cannot directly read the contents of address 2000 or the cached content of any of addresses 5001 to 5005, the rogue process can still use its side-channel attack to identify that address 5004 is in the cache and the other addresses between 5001 and 5005 are not, so it can still determine that the address that the instruction would have tried to read is 5004, and therefore that the content of unauthorized address 2000 is "4".
Meltdown uses this technique in sequence to read every address of interest at high speed, and depending on other running processes, the result may contain passwords, encryption data, and any other sensitive information, from any address of any process that exists in its memory map. In practice because cache side-channel attacks are slow, it's faster to extract data one bit at a time (only 2 × 8 = 16 cache attacks needed to read a byte, rather than 256 steps if it tried to read all 8 bits at once).
Impact[edit]
The impact of Meltdown depends on the design of the CPU, the design of the operating system (specifically how it uses memory paging), and the ability of a malicious party to get any code run on that system, as well as the value of any data it could read if able to execute.
CPU – Many of the most widely used modern CPUs from the late 1990s until early 2018 have the required exploitable design. However, it is possible to mitigate it within CPU design. A CPU that could detect and avoid memory access for unprivileged instructions, or was not susceptible to cache timing attacks or similar probes, or removed cache entries upon non-privilege detection (and did not allow other processes to access them until authorized) as part of abandoning the instruction, would not be able to be exploited in this manner. Some observers consider that all software solutions will be "workarounds" and the only true solution is to update affected CPU designs and remove the underlying weakness.
Operating system – Most of the widely used and general-purpose operating systems use privilege levels and virtual memory mapping as part of their design. Meltdown can only access pages that are memory mapped so the impact will be greatest if all active memory and processes are memory mapped in every process and have the least impact if the operating system is designed so that almost nothing can be reached in this manner. An operating system might also be able to mitigate in software to an extent by ensuring that probe attempts of this kind will not reveal anything useful. Modern operating systems use memory mapping to increase speed so this could lead to performance loss.
Virtual machine – Meltdown attack cannot be used to break out of a virtual machine, i.e., in fully virtualized machines guest user space can still read from guest kernel space, but not from host kernel space.[67] The bug enables reading memory from address space represented by the same page table, meaning the bug does not work between virtual tables. That is, Guest-to-Host page tables are unaffected, only Guest-to-same-Guest or Host-to-Host, and of course Host-to-Guest since the host can already access the guest pages. This means different VMs on the same fully virtualized hypervisor cannot access each other's data, but different users on the same guest instance can access each other's data.[68]
Embedded device – Among the vulnerable chips are those made by ARM and Intel designed for standalone and embedded devices, such as mobile phones, smart TVs, networking equipment, vehicles, hard drives, industrial control, and the like. As with all vulnerabilities, if a third party cannot run code on the device, its internal vulnerabilities remain unexploitable. For example, an ARM processor in a cellphone or Internet of Things "smart" device may be vulnerable, but the same processor used in a device that cannot download and run new code, such as a kitchen appliance or hard drive controller, is believed to not be exploitable.[69][better source needed]
Impact itself depends on the implementation of the address translation mechanism in the OS and the underlying hardware architecture. The attack can reveal the content of any memory that is mapped into a user address space, even if otherwise protected. For example, before kernel page-table isolation is introduced, most versions of Linux map all physical memory into the address space of every user-space process; the mapped addresses are (mostly) protected, making them unreadable from user-space and accessible only when transitioned into the kernel. The existence of these mappings makes transitioning to/from the kernel faster, but is unsafe in the presence of this Meltdown vulnerability, as the contents of all physical memory (which may contain sensitive information such as passwords belonging to other processes or the kernel) can then be obtained via the above method by any unprivileged process from user-space.
According to researchers, "every Intel processor that implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013)."[41] Intel responded to the reported security vulnerabilities with an official statement.[70]
The vulnerability is expected to impact major cloud providers, such as Amazon Web Services (AWS)[71] and Google Cloud Platform. Cloud providers allow users to execute programs on the same physical servers where sensitive data might be stored, and rely on safeguards provided by the CPU to prevent unauthorized access to the privileged memory locations where that data is stored, a feature that the Meltdown exploit circumvents.
One of the paper's authors reports that paravirtualization (Xen) and containers such as Docker, LXC, and OpenVZ, are affected.[67] They report that the attack on a fully virtualized machine allows the guest user space to read from the guest kernel memory, but not read from the host kernel space.
Mitigation[edit]
Further information: Kernel page-table isolation
Mitigation of this vulnerability requires changes to operating system kernel code, including increased isolation of kernel memory from user-mode processes.[3] Linux kernel developers have referred to this measure as kernel page-table isolation (KPTI). KPTI patches have been developed for Linux kernel 4.15, and have been released as a backport in kernels 4.14.11, 4.9.75.[72][73][74][75] Red Hat released kernel updates to their Red Hat Enterprise Linux distributions version 6[76] and version 7.[77] CentOS also already released their kernel updates to CentOS 6[78] and CentOS 7.[79]
Apple included mitigations in macOS 10.13.2, iOS 11.2, and tvOS 11.2. These were released a month before the vulnerabilities were made public.[80][81][82][83] Apple has stated that watchOS and the Apple Watch are not affected.[84] Additional mitigations were included in a Safari update as well a supplemental update to macOS 10.13, and iOS 11.2.2.[85][86][87][88][89]
Microsoft released an emergency update to Windows 10, 8.1, and 7 SP1 to address the vulnerability on January 3, 2018,[90][91][92] as well as Windows Server (including Server 2008 R2, Server 2012 R2, and Server 2016) and Windows Embedded Industry.[93] These patches are incompatible with third-party antivirus software that use unsupported kernel calls; systems running incompatible antivirus software will not receive this or any future Windows security updates until it is patched, and the software adds a special registry key affirming its compatibility.[94][95][96] The update was found to have caused issues on systems running certain AMD CPUs, with some users reporting that their Windows installations did not boot at all after installation. On January 9, 2018, Microsoft paused the distribution of the update to systems with affected CPUs while it investigates and addresses this bug.[94]
It was reported that implementation of KPTI may lead to a reduction in CPU performance, with some researchers claiming up to 30% loss in performance, depending on usage, though Intel considered this to be an exaggeration.[18] It was reported that Intel processor generations that support process-context identifiers (PCID), a feature introduced with Westmere[97] and available on all chips from the Haswell architecture onward, were not as susceptible to performance losses under KPTI as older generations that lack it.[98][99] This is because the selective translation lookaside buffer (TLB) flushing enabled by PCID (also called address space number or ASN under the Alpha architecture) enables the shared TLB behavior crucial to the exploit to be isolated across processes, without constantly flushing the entire cache – the primary reason for the cost of mitigation.
A statement by Intel said that "any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time".[20][19] Phoronix benchmarked several popular PC games on a Linux system with Intel's Coffee Lake Core i7-8700K CPU and KPTI patches installed, and found that any performance impact was little to non-existent.[51] In other tests, including synthetic I/O benchmarks and databases such as PostgreSQL and Redis, a measurable impact in performance was found.[100]
Several procedures to help protect home computers and related devices from the Meltdown and Spectre security vulnerabilities have been published.[14][15][16][17] Meltdown patches may produce performance loss.[18][19][20] On January 18, 2018, unwanted reboots, even for newer Intel chips, due to Meltdown and Spectre patches, were reported.[22] According to DELL computers: "No 'real-world' exploits of these vulnerabilities [ie, Meltdown and Spectre] have been reported to date [January 26, 2018], though researchers have produced proof-of-concepts."[23][24] Further, recommended preventions include: "promptly adopting software updates, avoiding unrecognized hyperlinks and websites, not downloading files or applications from unknown sources ... following secure password protocols ... [using] security software to help protect against malware (advanced threat prevention software or anti-virus)."[23][24]
On January 25, 2018, the current status and possible future considerations in solving the Meltdown and Spectre vulnerabilities were presented.[25]
Summary of mitigations on Microsoft Windows[101]
Vulnerability
CVE
Exploit Name
Public Vulnerability Name
Windows Changes
Firmware Changes
(Spectre) 2017-5753 Variant 1 Bounds Check Bypass Recompiling with a new compiler
Hardened Browser to prevent exploit from JavaScript No
(Spectre) 2017-5715 Variant 2 Branch Target Injection New CPU instructions eliminating branch speculation Yes
Meltdown 2017-5754 Variant 3 Rogue Data Cache Load Isolate kernel and user mode page tables No
See also[edit]
Intel Management Engine - an Intel subsystem which was discovered to have a major security vulnerability in 2017
Pentium F00F bug
Pentium FDIV bug
Row hammer – an unintended side effect in dynamic random-access memory causing memory cells to interact electrically
References[edit]
Jump up ^ "About speculative execution vulnerabilities in ARM-based and Intel CPUs".
^ Jump up to: a b Arm Ltd. "Arm Processor Security Update". ARM Developer.
^ Jump up to: a b Bright, Peter (January 5, 2018). "Meltdown and Spectre: Here's what Intel, Apple, Microsoft, others are doing about it". Ars Technica. Retrieved January 6, 2018.
^ Jump up to: a b "Apple Confirms 'Meltdown' and 'Spectre' Vulnerabilities Impact All Macs and iOS Devices, Some Fixes Already Released".
Jump up ^ Vaughan-Nichols, Steven J. (January 11, 2018). "Major Linux distros have Meltdown patches, but that's only part of the fix". ZDNet. Retrieved January 16, 2018.
Jump up ^ "CVE-2017-5754". security-tracker.debian.org. Retrieved January 16, 2018.
Jump up ^ "CERT: "Meltdown and Spectre" CPU Security Flaw Can Only Be Fixed by Hardware Replacement – WinBuzzer". January 4, 2018.
^ Jump up to: a b "Kernel-memory-leaking Intel processor design flaw forces Linux, Windows redesign". The Register.
Jump up ^ "Industry Testing Shows Recently Released Security Updates Not Impacting Performance in Real-World Deployments". Intel newsroom. January 4, 2018. Retrieved January 5, 2018.
Jump up ^ Schneier, Bruce. "Spectre and Meltdown Attacks Against Microprocessors - Schneier on Security". www.schneier.com. Retrieved January 9, 2018.
Jump up ^ "This Week in Security: Internet Meltdown Over Spectre of CPU Bug". Cylance.com. 2018-01-05. Retrieved 2018-01-30.
Jump up ^ "Meltdown, Spectre: here's what you should know". Rudebaguette.com. 2018-01-08. Retrieved 2018-01-30.
Jump up ^ King, Ian; Kahn, Jeremy; Webb, Alex; Turner, Giles (January 8, 2018). "'It Can't Be True.' Inside the Semiconductor Industry's Meltdown". Bloomberg Technology. Bloomberg L.P. Archived from the original on January 10, 2018. Retrieved January 10, 2018.
^ Jump up to: a b Metz, Cade; Chen, Brian X. (January 4, 2018). "What You Need to Do Because of Flaws in Computer Chips". The New York Times. Retrieved January 5, 2018.
^ Jump up to: a b Pressman, Aaron (January 5, 2018). "Why Your Web Browser May Be Most Vulnerable to Spectre and What to Do About It". Fortune. Retrieved January 5, 2018.
^ Jump up to: a b Chacos, Brad (January 4, 2018). "How to protect your PC from the major Meltdown and Spectre CPU flaws". PC World. Retrieved January 4, 2018.
^ Jump up to: a b Elliot, Matt (January 4, 2018). "Security – How to protect your PC against the Intel chip flaw – Here are the steps to take to keep your Windows laptop or PC safe from Meltdown and Spectre". CNET. Retrieved January 4, 2018.
^ Jump up to: a b c "Computer chip scare: What you need to know". BBC News. January 4, 2018. Retrieved January 4, 2018.
^ Jump up to: a b c d Metz, Cade; Perlroth, Nicole (January 3, 2018). "Researchers Discover Two Major Flaws in the World's Computers". The New York Times. ISSN 0362-4331. Retrieved January 3, 2018.
^ Jump up to: a b c "Intel says processor bug isn't unique to its chips and performance issues are 'workload-dependent'". The Verge. Retrieved January 4, 2018.
Jump up ^ Hachman, Mark (January 9, 2018). "Microsoft tests show Spectre patches drag down performance on older PCs". PC World. Retrieved January 9, 2018.
^ Jump up to: a b Tung, Liam (January 18, 2018). "Meltdown-Spectre: Intel says newer chips also hit by unwanted reboots after patch - Intel's firmware fix for Spectre is also causing higher reboots on Kaby Lake and Skylake CPUs". ZDNet. Retrieved January 18, 2018.
^ Jump up to: a b c d Staff (January 26, 2018). "Microprocessor Side-Channel Vulnerabilities (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754): Impact on Dell products". Dell. Retrieved January 26, 2018.
^ Jump up to: a b c d Staff (January 26, 2018). "Meltdown and Spectre Vulnerabilities". Dell. Retrieved January 26, 2018.
^ Jump up to: a b Hachman, Mark (January 25, 2018). "Intel's plan to fix Meltdown in silicon raises more questions than answers - But what silicon?!! Be sure and read the questions Wall Street should have asked". PC World. Retrieved January 26, 2018.
^ Jump up to: a b "Meltdown and Spectre". Spectreattack.com. Retrieved 2018-01-30.
Jump up ^ https://www.cybereason.com/blog/what-are-the-spectre-and-meltdown-vulnerabilities
Jump up ^ Sibert, Olin; Porras, Philip A.; Lindell, Robert (May 8, 1995). "The Intel 80x86 Processor Architecture: Pitfalls for Secure Systems" (PDF). Retrieved January 9, 2018.
Jump up ^ "OS X Mountain Lion Core Technologies Overview" (PDF). June 2012. Retrieved July 25, 2012.
Jump up ^ "Linux_3.14". kernelnewbies.org. December 30, 2017. Retrieved January 18, 2018.
Jump up ^ Fogh, Anders; Gruss, Daniel. "Blackhat USA 2016, Using Undocumented CPU Behavior to See into Kernel Mode and Break KASLR in the Process".
Jump up ^ Lipp, Moritz; Gruss, Daniel; Spreitzer, Raphael; Maurice, Clémentine; Mangard, Stefan (August 10, 2016). "ARMageddon: Cache Attacks on Mobile Devices" (PDF). Retrieved January 9, 2018.
Jump up ^ Maurice, Clémentine; Lipp, Moritz. "What could possibly go wrong with <insert x86 instruction here>?".
Jump up ^ Gras, Ben; Razavi, Kaveh; Bosman, Erik; Box, Herbert; Giuffrida, Cristiano (February 27, 2017). "ASLR on the Line: Practical Cache Attacks on the MMU". Retrieved January 9, 2018.
Jump up ^ Intel SGX Prime+Probe attack
Jump up ^ "KASLR is Dead: Long Live KASLR" (PDF).
Jump up ^ "ESSoS 2017: Engineering Secure Software and Systems".
Jump up ^ Gruss, Daniel (January 3, 2018). "#FunFact: We submitted #KAISER to #bhusa17 and got it rejected". Archived from the original on January 8, 2018. Retrieved January 8, 2018 – via Twitter.
^ Jump up to: a b c d Lipp, Moritz; Schwarz, Michael; Gruss, Daniel; Prescher, Thomas; Haas, Werner; Mangard, Stefan; Kocher, Paul; Genkin, Daniel; Yarom, Yuval; Hamburg, Mike. "Meltdown" (PDF). Meltdown and Spectre. p. 8 sec. 5.1. Retrieved January 4, 2018.
Jump up ^ "Negative Result Reading Kernel Memory from user Mode".
^ Jump up to: a b "Meltdown and Spectre: Which systems are affected by Meltdown?". meltdownattack.com. Retrieved January 3, 2018.
Jump up ^ "Kernel ASLR on amd64". 2017. Retrieved October 16, 2017.
Jump up ^ "Apple Open Source". 2017.
Jump up ^ Ionescu, Alex (November 14, 2017). "Windows 17035 Kernel ASLR/VA Isolation In Practice (like Linux KAISER)". Twitter. Archived from the original on January 6, 2018. Retrieved January 6, 2018.
Jump up ^ Gibbs, Samuel (January 4, 2018). "Meltdown and Spectre: 'worst ever' CPU bugs affect virtually all computers". The Guardian. Archived from the original on January 6, 2018. Retrieved January 6, 2018.
Jump up ^ "Information Leak via speculative execution side channel attacks (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754 aka Spectre and Meltdown)". Ubuntu Wiki. Retrieved January 4, 2018.
Jump up ^ Lynley, Matthew (January 28, 2018). "Intel reportedly notified Chinese companies of chip security flaw before the U.S. government". TechCrunch. Retrieved January 28, 2018.
Jump up ^ "A Critical Intel Flaw Breaks Basic Security for Most Computers". Wired. January 3, 2018.
^ Jump up to: a b c "Arm Processor Security Update". ARM Developer. ARM Ltd. January 3, 2018. Retrieved January 5, 2018.
Jump up ^ "Intel's processors have a security bug and the fix could slow down PCs". The Verge. Retrieved January 3, 2018.
^ Jump up to: a b "Linux Gaming Performance Doesn't Appear Affected By The x86 PTI Work – Phoronix". www.phoronix.com. Retrieved January 3, 2018.
Jump up ^ Lendacky, Tom. "[tip:x86/pti] x86/cpu, x86/pti: Do not enable PTI on AMD processors". lkml.org. Retrieved January 3, 2018.
Jump up ^ "Patches arrive for Intel's 'Meltdown' flaw — here's how to protect your device". January 4, 2018.
Jump up ^ "An Update on AMD Processor Security".
Jump up ^ "Who's affected by computer chip security flaw".
Jump up ^ "Kernel-memory-leaking Intel processor design flaw forces Linux, Windows redesign".
Jump up ^ Staff (2018). "Meltdown and Spectre-faq-systems-spectre". Graz University of Technology. Retrieved January 3, 2018.
Jump up ^ Busvine, Douglas; Nellis, Stephen (January 3, 2018). "Security flaws put virtually all phones, computers at risk". Reuters. Thomson-Reuters. Retrieved January 8, 2018.
Jump up ^ "Google: Almost All CPUs Since 1995 Vulnerable To "Meltdown" And "Spectre" Flaws".
Jump up ^ "P6 family microarchitecture". www.jaist.ac.jp.
Jump up ^ "Understanding Those Alarming Computer Chip Security Holes: 'Meltdown' and 'Spectre'".
Jump up ^ "'Spectre' and 'Meltdown': New CPU vulnerabilities affect most smartphones and computers". January 4, 2018.
Jump up ^ "Why Raspberry Pi isn't vulnerable to Spectre or Meltdown". Raspberry Pi. 2018-01-05. Retrieved 2018-01-30.
Jump up ^ Ibm Psirt Blog (2018-01-25). "Potential Impact on Processors in the POWER Family - IBM PSIRT Blog". Ibm.com. Retrieved 2018-01-30.
Jump up ^ Tung, Liam (2018-01-10). "Meltdown-Spectre: IBM preps firmware and OS fixes for vulnerable Power CPUs". ZDNet. Retrieved 2018-01-30.
Jump up ^ "Solaris+SPARC is Meltdown (CVE-2017-5754) free - Tales from the Datacenter". Tales from the Datacenter. January 22, 2018. Retrieved January 23, 2018.
^ Jump up to: a b Galowicz, Jacek (January 3, 2018). "Cyberus Technology Blog – Meltdown". blog.cyberus-technology.de.
Jump up ^ Wheeler, Eric (January 4, 2018). "Meltdown BUG: What about KVM/Xen/Docker/OpenVZ/LXC/PV-Xen/HyperV?". www.linuxglobal.com.
Jump up ^ Bhat, Akshay (January 17, 2018). "Meltdown and Spectre vulnerabilities". timesys.com. Retrieved January 23, 2018. unless your product allows running 3rd party or WEB applications, we believe the device is not exposed to exploits
Jump up ^ Staff (January 3, 2018). "Intel Responds To Security Research Findings". Intel. Retrieved January 4, 2018.
Jump up ^ "Processor Speculative Execution Research Disclosure". Amazon Web Services, Inc. Retrieved January 3, 2018.
Jump up ^ Kroah-Hartman, Greg (January 2, 2018). "Linux 4.14.11 Changelog". kernel.org.
Jump up ^ Kroah-Hartman, Greg (January 5, 2018). "Linux 4.9.75 Changelog". kernel.org.
Jump up ^ Corbet, Jonathon (November 15, 2017). "KAISER: hiding the kernel from user space". LWN. Retrieved January 3, 2018.
Jump up ^ Corbet, Jonathon (December 20, 2017). "The current state of kernel page-table isolation". LWN. Retrieved January 3, 2018.
Jump up ^ "RHSA-2018:0008 – Security Advisory". RedHat announcements.
Jump up ^ "RHSA-2018:0007 – Security Advisory". RedHat announcements.
Jump up ^ "[CentOS-announce] CESA-2018:0008 Important CentOS 6 kernel Security Update". CentOS announcements. January 4, 2018. Retrieved January 5, 2018.
Jump up ^ "[CentOS-announce] CESA-2018:0007 Important CentOS 7 kernel Security Update". CentOS announcements. January 4, 2018. Retrieved January 5, 2018.
Jump up ^ "Kernel-memory-leaking Intel processor design flaw forces Linux, Windows redesign". The Register. Retrieved January 3, 2018.
Jump up ^ "About the security content of macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan". Apple Support. Retrieved January 18, 2018.
Jump up ^ "About the security content of iOS 11.2". Apple Support. Retrieved January 18, 2018.
Jump up ^ "About the security content of tvOS 11.2". Apple Support. Retrieved January 18, 2018.
Jump up ^ "About speculative execution vulnerabilities in ARM-based and Intel CPUs". Apple Support. Retrieved January 18, 2018.
Jump up ^ "Apple Releases macOS High Sierra 10.13.2 Supplemental Update With Spectre Fix". Retrieved January 18, 2018.
Jump up ^ "Apple Releases iOS 11.2.2 With Security Fixes to Address Spectre Vulnerability". Retrieved January 18, 2018.
Jump up ^ "About the security content of Safari 11.0.2". Apple Support. Retrieved January 18, 2018.
Jump up ^ "About the security content of macOS High Sierra 10.13.2 Supplemental Update". Apple Support. Retrieved January 18, 2018.
Jump up ^ "About the security content of iOS 11.2.2". Apple Support. Retrieved January 18, 2018.
Jump up ^ Warren, Tom. "Microsoft issues emergency Windows update for processor security bugs". The Verge. Vox Media, Inc. Retrieved January 3, 2018.
Jump up ^ Thorp-Lancaster, Dan (January 3, 2018). "Microsoft pushing out emergency fix for newly disclosed processor exploit". Windows Central. Retrieved January 4, 2018.
Jump up ^ "Windows Client Guidance for IT Pros to protect against speculative execution side-channel vulnerabilities". support.microsoft.com. Retrieved January 4, 2018.
Jump up ^ "Windows Server Guidance to protect against the speculative execution side-channel vulnerabilities". Microsoft Support.
^ Jump up to: a b Ranger, Steve. "Windows Meltdown and Spectre patches: Now Microsoft blocks security updates for some AMD based PCs". ZDNet. Retrieved January 9, 2018.
Jump up ^ Tung, Liam. "Windows Meltdown-Spectre patches: If you haven't got them, blame your antivirus". ZDNet. Retrieved January 4, 2018.
Jump up ^ "Important information regarding the Windows security updates released on January 3, 2018 and anti-virus software". Microsoft. Retrieved January 4, 2018.
Jump up ^ "Westmere Arrives". www.realworldtech.com.
Jump up ^ "A Critical Intel Flaw Breaks Basic Security for Most Computers". Wired. Retrieved January 4, 2018.
Jump up ^ "Intel CPU kernel bug FAQ: Fix for massive security flaw could slow down PCs and Macs". PCWorld. Retrieved January 4, 2018.
Jump up ^ "Initial Benchmarks Of The Performance Impact Resulting From Linux's x86 Security Changes". Phoronix. Retrieved January 4, 2018.
Jump up ^ "Understanding the performance impact of Spectre and Meltdown mitigations on Windows Systems". Microsoft. January 9, 2018.
External links[edit]
Official website of the Meltdown and Spectre vulnerabilities
Google Project Zero write-up
CVE-2017-5754 at National Vulnerability Database
Meltdown's proof-of-concept released by researchers that also published the meltdown paper.
Am I Affected by Meltdown - Meltdown Checker Tool created by Raphael S. Carvalho
Meltdown/Spectre Checker Gibson Research Corporation
[show]
v
t
e
Hacking in the 2010s
← 2000s Timeline 2020s →
Major incidents
2010
Australian cyberattacks
Operation Aurora
Operation Payback
2011
DigiNotar
HBGary Federal
Operation AntiSec
Operation Tunisia
PlayStation
RSA SecurID compromise
2012
LinkedIn hack
Stratfor email leak
2013
South Korea cyberattack
Snapchat hack
2013 Yahoo! data breach
2014
Anthem medical data breach
Operation Tovar
iCloud leaks of celebrity photos
Sony Pictures hack
Russian hacker password theft
2014 Yahoo! data breach
2015
Office of Personnel Management data breach
Hacking Team
Ashley Madison data breach
VTech data breach
SWIFT banking hack
2016
Bangladesh Bank robbery
Hollywood Presbyterian Medical Center ransomware incident
Commission on Elections data breach
Democratic National Committee cyber attacks
DCCC cyber attacks
Dyn cyberattack
Russian interference in U.S. election
2017
WannaCry ransomware attack
Westminster cyberattack
Petya cyberattack
2017 cyberattacks on Ukraine
Equifax data breach
Deloitte breach
Disqus breach
2018
Trustico
Groups
Anonymous
associated events
Bureau 121
Cozy Bear
CyberBerkut
Derp
Equation Group
Fancy Bear
GNAA
Goatse Security
Guccifer 2.0
Hacking Team
Iranian Cyber Army
Lizard Squad
LulzRaft
LulzSec
New World Hackers
NullCrew
NSO Group
PayPal 14
PLA Unit 61398
PLATINUM
Pranknet
RedHack
Rocket Kitten
The Shadow Brokers
Syrian Electronic Army
TeaMp0isoN
Tailored Access Operations
UGNazi
Yemen Cyber Army
Individuals
George Hotz
Guccifer
Hector Monsegur
Jeremy Hammond
Junaid Hussain
Kristoffer von Hassel
Mustafa Al-Bassam
MLT
Ryan Ackroyd
Topiary
The Jester
weev
Major vulnerabilities
publicly disclosed
Evercookie (2010)
iSeeYou (2013)
Heartbleed (2014)
Shellshock (2014)
POODLE (2014)
Rootpipe (2014)
Row hammer (2014)
JASBUG (2015)
Stagefright (2015)
DROWN (2016)
Badlock (2016)
Dirty COW (2016)
Cloudbleed (2017)
Broadcom Wi-Fi (2017)
EternalBlue (2017)
DoublePulsar (2017)
Silent Bob is Silent (2017)
KRACK (2017)
ROCA vulnerability (2017)
BlueBorne (2017)
Meltdown (2018)
Spectre (2018)
Malware
Bad Rabbit
Careto / The Mask
CryptoLocker
Dexter
Duqu
Duqu 2.0
FinFisher
Flame
Gameover ZeuS
Mahdi
Metulji botnet
Mirai
NSA ANT catalog
Pegasus
Petya
R2D2
Shamoon
Stars virus
Stuxnet
Vault 7
WannaCry
X-Agent
Computer science portal
Computer security portal
Retrieved from "https://en.wikipedia.org/w/index.php?title=Meltdown_(security_vulnerability)&oldid=827581560"
Categories:
Computer security
Hardware bugs
Intel x86 microprocessors
Side-channel attacks
2018 in computer science
X86 architecture
X86 memory management
Hidden categories:
Articles needing cleanup from January 2018
All pages needing cleanup
Articles with sections that need to be turned into prose from January 2018
All articles lacking reliable references
Articles lacking reliable references from January 2018
Navigation menu
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
Namespaces
Article
Talk
Variants
Views
Read
Edit
View history
More
Search
Navigation
Main page
Contents
Featured content
Current events
Random article
Donate to Wikipedia
Wikipedia store
Interaction
Help
About Wikipedia
Community portal
Recent changes
Contact page
Tools
What links here
Related changes
Upload file
Special pages
Permanent link
Page information
Wikidata item
Cite this page
Print/export
Create a book
Download as PDF
Printable version
Languages
العربية
Català
Dansk
Deutsch
Español
فارسی
Français
한국어
Italiano
Latviešu
Lumbaart
മലയാളം
日本語
Português
Русский
Slovenčina
Svenska
Українська
中文
10 more
Edit links
This page was last edited on 25 February 2018, at 15:32.
Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.
Privacy policy
About Wikipedia
Disclaimers
Contact Wikipedia
Developers
Cookie statement
Mobile view
Enable previews

key: html

type: local

value: div

attrs: id class

values: mw-page-base noprint

values: mw-head-base noprint

value: a

attrs: id class lang

values: firstHeading firstHeading en

values: siteSub noprint

values: jump-to-nav mw-jump

value: img

attrs: alt src width height class srcset data-file-width data-file-height

attrs: href class

attrs: href class title

attrs: class style

value: b

attrs: href title

values:
/wiki/Intel_CPUs
mw-redirect
Intel CPUs

values:
/wiki/IBM_POWER_processors
mw-redirect
IBM POWER processors

values:
/wiki/ARM_microprocessors
mw-redirect
ARM microprocessors

value: sup

values:
/wiki/Cloud_service
mw-redirect
Cloud service

values:
/wiki/Embedded_device
mw-redirect
Embedded device

values:
/wiki/Cache_side-channel_attack
mw-redirect
Cache side-channel attack

attrs: alt src width height srcset data-file-width data-file-height

values:
/wiki/Wikipedia:Embedded_list
mw-redirect
Wikipedia:Embedded list

values: plainlinks metadata ambox ambox-style ambox-Prose

values:
/wiki/Timing_channels
mw-redirect
Timing channels

values: Kernel address space layout randomization

values:
/wiki/Black_Hat_(conference)
mw-redirect
Black Hat (conference)

values:
/wiki/Vrije_Universiteit_Amsterdam
mw-redirect
Vrije Universiteit Amsterdam

values:
/wiki/Cache_memory
mw-redirect
Cache memory

values:
/wiki/Project_Zero_(Google)
mw-redirect
Project Zero (Google)

values:
/wiki/ARM_Cortex-R7
mw-redirect
ARM Cortex-R7

values:
/wiki/ARM_Cortex-R8
mw-redirect
ARM Cortex-R8

values:
/wiki/IBM_System_Z
mw-redirect
IBM System Z

values: Edit section: Background – modern CPU design

values:
/wiki/Conditional_jump
mw-redirect
Conditional jump

values:
/wiki/Cache_timing_attack
mw-redirect
Cache timing attack

values:
/wiki/Side_channel
mw-redirect
Side channel

values:
/wiki/Instruction_set
mw-redirect
Instruction set

values:
/wiki/ARM_Holdings
mw-redirect
ARM Holdings

values:
/wiki/Internet_of_Things
mw-redirect
Internet of Things

values: This claim needs references to better sources. (January 2018)

values: noprint Inline-Template noprint noexcerpt Template-Fact

values:
/wiki/Intel_Itanium
mw-redirect
Intel Itanium

values:
/wiki/Cloud_provider
mw-redirect
Cloud provider

values:
/wiki/Container_(virtualization)
mw-redirect
Container (virtualization)

values:
/wiki/Windows_Server_2012_R2
mw-redirect
Windows Server 2012 R2

values:
/wiki/Registry_key
mw-redirect
Registry key

values:
/wiki/Process-context_identifier
mw-redirect
Process-context identifier

values:
/wiki/Address_space_number
mw-redirect
Address space number

values:
nofollow
external text
//www.worldcat.org/issn/0362-4331

values:
nofollow
https://spectreattack.com/
external text

values:
nofollow
external text
https://gruss.cc/files/kaiser.pdf

values:
nofollow
external text
https://meltdownattack.com/meltdown.pdf

values:
nofollow
external text
http://opensource.apple.com

values:
nofollow
external text
https://lkml.org/lkml/2018/1/3/425

values:
nofollow
https://lwn.net/Articles/738975/
external text

values:
nofollow
https://lwn.net/Articles/741878/
external text

values:
nofollow
https://www.realworldtech.com/westmere/
external text

values: -moz-column-width: 30em; -webkit-column-width: 30em; column-width: 30em; list-style-type: decimal;

values:
nofollow
https://meltdownattack.com/
external text

values:
nofollow
external text
https://github.com/IAIK/meltdown

values:
nofollow
external text
https://www.grc.com/inspectre.htm

values:
/wiki/Gibson_Research_Corporation
mw-redirect
Gibson Research Corporation

values: Timeline of computer security hacker history

values: text-align:left; vertical-align:middle; padding:0 0.5em 0 0;

values: text-align:center; vertical-align:middle; padding:0 1px;

values: text-align:right; vertical-align:middle; padding:0 0 0 0.5em;

values: Office of Personnel Management data breach

values: Democratic National Committee cyber attacks

values: Democratic Congressional Campaign Committee cyber attacks

values: Russian interference in the 2016 United States elections

values: Timeline of events associated with Anonymous

values: nowraplinks hlist collapsible collapsed navbox-inner

values:
noprint metadata navbox
navigation
Portals
font-weight:bold;padding:0.4em 2em

values: Category:Articles needing cleanup from January 2018

values: Category:Articles with sections that need to be turned into prose from January 2018

values: Category:All articles lacking reliable references

values: Category:Articles lacking reliable references from January 2018

values: Discussion about edits from this IP address [ctrl-alt-n]

values: A list of edits made from this IP address [ctrl-alt-y]

values: You are encouraged to create an account and log in; however, it is not mandatory

values:
/wiki/Meltdown_(security_vulnerability)
View the content page [ctrl-alt-c]
c

values: Featured content – the best of Wikipedia

values: Find background information on current events

values:
/wiki/Special:Random
Load a random article [ctrl-alt-x]
x

values: portal navigation p-navigation p-navigation-label

values: Guidance on how to use and edit Wikipedia

values: About the project, what you can do, where to find things

values: A list of recent changes in the wiki [ctrl-alt-r]

values: portal navigation p-interaction p-interaction-label

values: List of all English Wikipedia pages containing links to this page [ctrl-alt-j]

values: Recent changes in pages linked from this page [ctrl-alt-k]

values:
/wiki/Wikipedia:File_Upload_Wizard
Upload files [ctrl-alt-u]
u

values: A list of all special pages [ctrl-alt-q]

values: Permanent link to this revision of the page

values: Link to connected data repository item [ctrl-alt-g]

values: Printable version of this page [ctrl-alt-p]

values: ميلتداون – Arabic

values:
https://ca.wikipedia.org/wiki/Meltdown
Meltdown – Catalan
ca
ca
interlanguage-link-target

values:
interlanguage-link interwiki-ca
display: none;

values:
interlanguage-link interwiki-da
display: none;

values: ملتداون (آسیب‌پذیری امنیتی) – Persian

values:
interlanguage-link interwiki-fa
display: none;

values: Meltdown (vulnerabilità di sicurezza) – Italian

values:
interlanguage-link interwiki-it
display: none;

values:
interlanguage-link interwiki-lv
display: none;

values:
https://lmo.wikipedia.org/wiki/Meltdown
Meltdown – Lombard
lmo
lmo
interlanguage-link-target

values:
interlanguage-link interwiki-lmo
display: none;

values: മെൽറ്റ്ഡൌൺ (സുരക്ഷാ പാളിച്ച) – Malayalam

values:
interlanguage-link interwiki-ml
display: none;

values:
https://ja.wikipedia.org/wiki/Meltdown
Meltdown – Japanese
ja
ja
interlanguage-link-target

values:
interlanguage-link interwiki-sk
display: none;

values:
interlanguage-link interwiki-sv
display: none;

values:
interlanguage-link interwiki-uk
display: none;

values: All languages (initial selection from common choices by you and others)

values: mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject page-Meltdown_security_vulnerability rootpage-Meltdown_security_vulnerability skin-vector action-view