I've found a good deal on an Intel SSD but I don't want to worry about the security hole or the loss of performance from patching it.
2
-
1No. There are chips in SSDs but they do not run "untrusted" code the way your CPU does.– Jonah BentonJul 31, 2018 at 14:35
-
@JonahBenton That should be an answer :)– vidarloJul 31, 2018 at 19:03
Add a comment
|
1 Answer
No, those types of hardware should be fine. It is somewhat unlikely that the microprocessors on such devices are even capable of speculative execution (for Spectre) or are vulnerable to the particular pipeline bug that gives us Meltdown. Even if the microprocessors were vulnerable, though, the code they are running is generally fully trusted, whereas Spectre and Meltdown require that the processor run untrusted code (such as in a browser's JS engine, an operating system's least-privileged/non-supervisor ring/mode, or a hypervisor's guest OS) on the same CPU where the data the attacker wants to steal is handled. No untrusted code execution on the microcontrollers probably * means no way to steal data from them, and thus no need to patch them against issues like this.
* There is a way to attack some devices with Spectre-vulnerable processors over the network, without running local code on the devices themselves. However, it is unlikely this attack could be carried out by untrusted code on a computer, and fully-trusted code can read anything it wants to off the disk anyhow.
