Questions tagged [meltdown]

A side-channel vulnerability affecting Intel x86 and few ARM-based microprocessors allowing user processes to read memory belonging to the kernel. Affects various OSes like Linux, OS X, and Windows. Published in January 2018.

Filter by
Sorted by
Tagged with
3 votes
0 answers
121 views

How to select a CPU to buy for the best security?

Various versions of Spectre, Meltdown, Foreshadow and ZombieLoad make it quite the jungle trip to navigate which CPUs are affected, how to mitigate them. Right now, my problem is that I need a new ...
user avatar
  • 131
1 vote
1 answer
97 views

Are CPU side-channel attacks still a concern on VPSs

I've been looking into getting a VPS to run an OpenVPN server on and a few other things. I've been speaking to a hosting company and they have sent me this screenshot to show they are protected ...
user avatar
  • 99
1 vote
1 answer
161 views

Does enabling SharedArrayBuffers via service worker headers create Spectre vulnerability?

In browsers, use of SharedArrayBuffer is restricted to sites with the following HTTP headers because otherwise it exposes vulnerabilities to Spectre and Meltdown. Cross-Origin-Embedder-Policy: require-...
user avatar
1 vote
1 answer
122 views

Is protecting against Meltdown and Spectre on virtual servers actually possible?

I've been reading into the Meltdown and Spectre bugs recently and the issues they cause for virtualised servers, as memory in one VM can potentially be accessed by another user in a separate VM with ...
user avatar
  • 99
0 votes
1 answer
165 views

Understanding the Meltdown vulnerability

I need to write a simple program that demonstrates a race condition. I picked the Meltdown vulnerability. I want to clarify something. I'm following this explanation https://resources.infosecinstitute....
user avatar
0 votes
1 answer
153 views

Are there any class of systems where it is safe to disable spectre and meltdown patches

I was not able to find a definite answer to the question whether it is safe to disable spectre and meltdown vulnerabilities but i could articles that suggests the defaults might be revisited & ...
user avatar
1 vote
2 answers
128 views

Can a meltdown attack also violate data integrity of other processes or is it just violating data secrecy?

Can a meltdown attack also violate data integrity of other processes by obtaining different passwords or is it just violating data secrecy by reading data it is unauthorized to do?
user avatar
1 vote
0 answers
153 views

Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR

I'm trying to understand and perform the Prefetch Side-Channel Attacks:Bypassing SMAP and Kernel ASLR. The author have released the proof-of-concept code. I'm trying to run the attack on my Intel ...
user avatar
  • 111
0 votes
0 answers
118 views

Secure code makes exploitation easier with CPU vulnerabilities?

I researched CPU vulnerabilities in the past, such as Specter and Meltdown. I read that one of those attacks is made easier if the code is a certain way. I cannot remember if it was related to being ...
user avatar
2 votes
1 answer
148 views

are small SOC chips also affected by Meltdown and Spectre?

How can I find out, if given CPU is affected by the Meltdown and Spectre bugs ? My CPU is relatively older, and it is a SOC chip: AMD GX-412TC SOC I was not able to find, whether these chips also ...
user avatar
1 vote
0 answers
112 views

How would one compare Cache Allocating Technology against MIT's Dynamically Allocated Way Guard for prevention of the Spectre side-channel Attack?

Upon research, I'm finding it difficult to identify a way to compare each solution. Is it correct in saying both solutions are software based? Therefore, could I compare overall PC perfomance with ...
user avatar
  • 11
6 votes
1 answer
278 views

How risky would it be to run a Linux kernel without Spectre and Meltdown patches on a regular desktop system?

What would happen if we adopted: https://make-linux-fast-again.com/ Assume the system is used for development and general browsing. Are there any cases of these vulnerabilities being exploited in ...
user avatar
  • 161
1 vote
1 answer
221 views

Application level protection against Meltdown, Spectre, Foreshadow, Fallout. Zombieload

Is it possible to develop an application in such a way that its data in memory cant be stolen by recent attacks such as Meltdown, Spectre, Foreshadow, Fallout. Zombieload? All mitigations focus on ...
user avatar
  • 1,824
1 vote
0 answers
152 views

Software mitigation for variant 3a (rogue system register read) and variant 4 (speculative store bypass)

AFAIK, all mitigable meltdown / spectre variants have software mitigation except for variant 3a and 4. Why is this the case? For variant 4, a straightforward software mitigation is to place lfence ...
user avatar
  • 182
3 votes
2 answers
617 views

Why must Meltdown use probe array?

This is code snippet of Meltdown assembly language code: 1. ; rcx = kernel address, rbx = probe array 2. xor rax, rax 3. retry: 4. mov al, byte [rcx] 5. shl rax, 0xc 6. jz retry 7. mov rbx, ...
user avatar
2 votes
1 answer
2k views

Is Meltdown/Spectre mitigation necessary in virtual machine as well as in hypervisor? [duplicate]

I am running virtual machines in kvm/qemu hypervisor. The hypervisor has Meltdown/Spectre mitigation enabled in kernel. Is it necessary that virtual machines have the Meltdown/Spectre mitigation ...
user avatar
0 votes
0 answers
171 views

Meltdown checker says AWS and Rackspace is vulnerable - Why?

Today I was curious how my vmware environment stacked up against Spectre and Meltdown. So I ran spectre-meltdown-checker. It came back clean with 7 of 8 variants OK (the failed one is apparently ...
user avatar
  • 1,150
2 votes
2 answers
194 views

Can someone explain in layman terms how Spectre and Meltdown expose protected data

I'm working on a document about them and I think I understand it general what happens -> by exploiting the CPUs memory caching and speculative execution but I'm a little lost of how protected data is ...
user avatar
  • 123
2 votes
1 answer
632 views

Mitigation of Spectre and Meltdown affecting host OS from guest OS (Virtualbox)

I don't know all the details of Spectre and Meltdown, but the way I understand it is that they allow reading from memory, not writing to it. Also, I read that at least Spectre can get out of the ...
user avatar
  • 15.3k
16 votes
2 answers
3k views

Are new AMD processors more secure than Intel ones?

Since the discovery of Meltdown and Spectre, CPU security has been compromised and trust to the main manufacturers reduced, particularly Intel. 8 months later I wonder, what CPUs are more secure at ...
user avatar
2 votes
1 answer
1k views

Privacy implications of Intel CPU backdoors [closed]

I didn't follow all the episodes about backdoors in Intel CPUs What can intelligence or law enforcement agencies potentially do on a computer equipped with a vulnerable Intel CPU (connected to the ...
user avatar
5 votes
1 answer
969 views

Can speculative execution on intel cpu be disabled?

In the light of all the recent Intel Vulnerabilities with speculative execution, can speculative execution be fully disabled to protect from all this vulnerabilities, from BIOS or OS kernel? Maybe ...
user avatar
3 votes
1 answer
367 views

How to fix Spectre variant 3a and variant 4?e

How I can fix CVE-2018-3640 [rogue system register read] aka 'Variant 3a' and CVE-2018-3639 [speculative store bypass] aka 'Variant 4'? My status for them is VULNERABLE. I have Intel CPU and using ...
user avatar
0 votes
1 answer
172 views

Do Meltdown and Spectre affect other Intel products such as SSDs?

I've found a good deal on an Intel SSD but I don't want to worry about the security hole or the loss of performance from patching it.
user avatar
  • 113
-1 votes
2 answers
170 views

Extracting passwords from recycled machine using Spectre and Meltdown

With Spectre and Meltdown, hackers can extract your password from the CPU cache. If I give someone my computer without the hard drive, can he extract my passwords through the CPU?
user avatar
1 vote
0 answers
347 views

Nessus ADV180002: Microsoft SQL Server January 2018 Security Update (Meltdown) (Spectre)

I have a MS Server 2012 r2 running ArcServe 17.5, which uses MSSQL Server Express 2014. When Nessus runs a scan of this system, I am getting the plugin 105613 - ADV180002: Microsoft SQL Server January ...
user avatar
2 votes
2 answers
304 views

Should I wait until Spectre and Meltdown is fixed in hardware? [duplicate]

I have a Laptop that needs replacing due to age. I will be using this laptop for desktop use, including Office Apps, Development, Running VMs & Web Browsing. I will be using separation using ...
user avatar
3 votes
1 answer
605 views

Meltdown and Spectre regarding Firewalls and Sandboxing [duplicate]

I don't deeply understand Meltdown and Spectre -- all I know is that they are basically keylogging-like vulnerabilities within the CPU, which bypass any application layer stuff; correct me if I'm ...
user avatar
  • 39
1 vote
2 answers
248 views

What is the significance of Spectre and Meltdown?

Reading up on Spectre and Meltdown attacks again, I don't get why they were hyped so much. These are cache attacks that take advantage of the instruction pipeline processing implementation in ...
user avatar
  • 95
-1 votes
2 answers
104 views

How bits/bytes are handled after performing Meltdown? [closed]

I understand how it works but for example after reading 4 bytes, how do it undertand if it was originally an integer or 4 different characters? Both of them could give a meaningfull result.
user avatar
48 votes
3 answers
15k views

Are new Intel CPUs vulnerable to Meltdown/Spectre?

Has Intel released any information about new processors? According to their advisory a number of processors are susceptible, but it says nothing about when new processors will be fixed. Also Meltdown ...
user avatar
  • 585
2 votes
1 answer
941 views

how did the meltdown attack break KASLR in 128 steps for a target machine with 8GB RAM with 40bit randomization on a 64bit machine?

In the meltdown official paper released the authors broke the KASLR with 128 steps at worse. Unable to understand how did they come down to that number Paper for reference
user avatar
  • 123
1 vote
2 answers
189 views

What to do against Spectre-1, Sprectre-2 and Meltdown on Linux and Windows in 01/2018? [duplicate]

How to handle Spectre-1, Spectre-2 and Meltdown for now, in 01/2018? It can almost never be wrong to do the following Stay up to date with your browser and OS e.g. Linux kernel update Update anti-...
user avatar
3 votes
1 answer
472 views

Adobe Flash and Meltdown / Spectre

Many browsers have received updates to protect against the Meltdown and Spectre attacks. I presume these patches relate (solely) to JavaScript execution within the browser. Java in the browser is as ...
user avatar
6 votes
2 answers
588 views

Spectre/Meltdown - Does memory deallocation erase the actual RAM contents?

The other day I've been thinking about Spectre and Meltdown and the ability of one process to access the memory of another. On my Linux system currently I have all JavaScript disabled to eliminate ...
user avatar
  • 161
2 votes
0 answers
197 views

Meltdown - Reading processes info from leaked memory [closed]

Found this video: https://www.youtube.com/watch?v=De4rBaAdKNA In the video Meltdown is used to read process memory based by PID/name. How it is done? The program looks for task_struct in leaked ...
user avatar
  • 937
1 vote
2 answers
500 views

Spectre, Meltdown to read SSH keys

I've got a VPS running on Ubuntu, accessed through SSH, passwordless and with a public key. Can Spectre and Meltdown be used to compromise it in order to get access remotely eg by reading the private ...
user avatar
  • 2,099
9 votes
3 answers
328 views

How can CPU designers prevent information leaks from speculated execution?

We know about short-term measures to mitigate the Meltdown and Spectre vulnerabilities in certain microprocessors where speculative execution has measurable effects on cache timings (mainly patches to ...
user avatar
  • 1,204
3 votes
1 answer
516 views

Is microcode physically able to mitigate Meltdown?

I am aware that there is no microcode fix for Meltdown available (it has already been answered in various questions), and that the only extant microcode patches (IBRS and IPBP) only help with one of ...
user avatar
  • 64k
1 vote
1 answer
286 views

how do CPU cache side-channel attack fit into the background of Meltdown vulnerability? [duplicate]

NOTE:I know there are similar questions out there, namely this one, but that answer is just an extraction from original paper, which didn't clarify the attack. Additionally I can see from answers ...
user avatar
  • 271
53 votes
3 answers
16k views

Is it true that meltdown and spectre were intended as debug tools?

I heard from a guy that's involved in low-level (assembler, C for drivers and OSes) programming, that meltdown and spectre weren't actually vulnerabilities discovered only so recently, but they were ...
user avatar
  • 663
36 votes
6 answers
10k views

On Windows boxes, is patching for Spectre and Meltdown necessary?

From what I've read, Spectre and Meltdown each require rogue code to be running on a Windows box in order for attacks to take place. The thing is, once a box has rogue code running, it's already ...
user avatar
2 votes
1 answer
297 views

Spectre: Problem with Understanding POC - Reading data from cache

I understand the vulnerability (Spectre) and, in theory, what the PoC does. But I do not understand the part of the PoC, when it reads or identifys the data from the cache, between the lines 86 - 108. ...
user avatar
14 votes
1 answer
796 views

Is anyone seeing a performance decrease after applying recent kernel patch fixing Meltdown and Spectre? [closed]

Our company has a lot of CPU intensive operations on our servers, so the performance decrease is a concern for the organization. We did the benchmarks, and it seems that performance is almost not ...
user avatar
1 vote
2 answers
241 views

Meltdown & UEFI

I've been trying to understand the risk of an unprotected BIOS being the victim of an UEFI attack using Meltdown and what the risks are compared to the bug being unpatched in the OS. What is required ...
user avatar
  • 237
3 votes
1 answer
356 views

Meltdown - PoC - Reading physical address with KASLR disabled does not work

Working with this PoC https://github.com/IAIK/meltdown Running it: # ./secret [+] Secret: Sample text [+] Virtual address of secret: 0x4af528 [+] Physical address of secret: 0x172bc3528 [+] Exit ...
user avatar
  • 937
3 votes
2 answers
299 views

How does the side channel actually access the contents of kernel memory in Meltdown?

In the Meltdown paper it mentions it can identify kernel memory address being accessed. The part I don't understand is how the FLUSH+RELOAD channel works to identify what the contents of the memory ...
user avatar
  • 133
-3 votes
1 answer
168 views

Are PCs really vulnerable to Spectre type attacks due to virtual user space addressing? [duplicate]

Are Windows OS user programs vulnerable to Spectre and the other recent Intel flaws? Wouldn't the virtual memory assignment in Windows prevent such attacks, or their usefulness? Sorry if I miss ...
user avatar
4 votes
2 answers
336 views

Will patching a higher layer protect against the spectre/meltdown vulnerability in a lower layer?

The question I am about to ask is similar to the following question: Do I need to patch Linux for Meltdown/Spectre if the hypervisor has been patched, and I trust the guest? However, I would like to ...
user avatar
14 votes
1 answer
2k views

Was Meltdown/Spectre discovered in 1991 or 1995?

Wikipedia mentions this paper without going into details: The Intel 80x86 Processor Architecture: Pitfalls for Secure Systems: As mentioned in the preceding scenario, caches present potential for ...
user avatar
  • 615