Questions tagged [meltdown]
A side-channel vulnerability affecting Intel x86 and few ARM-based microprocessors allowing user processes to read memory belonging to the kernel. Affects various OSes like Linux, OS X, and Windows. Published in January 2018.
95
questions
14
votes
1
answer
2k
views
Was Meltdown/Spectre discovered in 1991 or 1995?
Wikipedia mentions this paper without going into details: The Intel 80x86 Processor Architecture: Pitfalls for Secure Systems:
As mentioned in the preceding scenario, caches
present potential for ...
- 615
5
votes
1
answer
406
views
Are mitigations for Spectre and Meltdown needed in the VMs for dynamic languages other than JavaScript?
Mitigations for Spectre and Meltdown are being added to the JavaScript VMs in Chrome, Firefox, IE/Edge and WebKit.
Are similar mitigations also needed in the VMs for other dynamic languages?
For ...
- 151
8
votes
1
answer
1k
views
Intel firmware/microcode updates that make processors "immune" to both Spectre and Meltdown?
Recently Intel has claimed the following in a press release (emphasis added):
SANTA CLARA, Calif., Jan. 4, 2018 — Intel has developed and is rapidly issuing updates for all types of Intel-based ...
- 8,834
5
votes
1
answer
512
views
Why were Meltdown and Spectre disclosed at the same time?
Both the Meltdown and Spectre vulnerabilities were publicly disclosed on January 3, 2018. (6 days ahead of the originally planned January 9).
Since their public reveal, there has been some confusion ...
- 1,535
1
vote
1
answer
483
views
Meltdown - Reading Process Memory Data
Tried this PoC:
https://github.com/mniip/spectre-meltdown-poc
Which works for the sys_call_table.
I was able to read the syscall sys_read address.
Wanted to test it with a sample program to read ...
- 977
5
votes
2
answers
614
views
Why and where was Meltdown made public before schedule for the first time?
Originally, Meltdown and Spectre had a coordinated disclosure date of January 9, 2018. Some vendors were preparing to release fixes at that time, and were caught by surprise when the vulnaribilities ...
- 284
4
votes
2
answers
363
views
What is the expected performance impact/loss of meltdown/spectre patches? [duplicate]
The patches related to the mitigation of meltdown and spectre attacks, have they caused significant and noticeable slow down of execution in systems they have been applied to?
- 275
8
votes
1
answer
640
views
Mitigating Meltdown by checking the faulting address in every page fault?
Short question
Would checking if the faulting address for every page fault points to kernel memory reliably detect an attempted Meltdown exploit, on systems that lack Intel TSX (and thus cannot ...
- 66.5k
5
votes
1
answer
804
views
Reducing resolution of timers as mitigation against Meltdown and Spectre
I have read that Firefox' current mitigation against Meltdown and Spectre (from 57.x) consists of the following:
The resolution of performance.now() will be reduced to 20µs.
The ...
- 391
2
votes
1
answer
151
views
Meltdown and Spectre vs. dcache timing and dcache leak issues
I've heard an expert (or "expert") laugh the current focus on Meltdown and Spectre off by arguing that dcache timing and dcache leak issues have been known and around for years (so nothing new there .....
- 391
1
vote
1
answer
433
views
How can a userspace linux process refer to a kernel address?
I would like help understanding a particular aspect of meltdown.
My understanding is that the meltdown bug can be used for a userspace linux process to access kernel memory (indirectly, through a ...
- 183
13
votes
2
answers
434
views
Why are CPUs designed in a way so the "meltdown" exploit works? [duplicate]
I'm trying to wrap my head around "meltdown", but to first understand it, I've been trying to understand memory accesses.
From what I understand, the CPU attempts to look up the virtual address in ...
- 231
54
votes
4
answers
15k
views
Spectre/meltdown on a GPU
Are GPUs vulnerable to spectre/meltdown attacks, since they have most of what makes CPUs attackable? Is there any information in the VRAM, that would cause trouble if it was stolen?
- 613
2
votes
1
answer
1k
views
Could Meltdown/Spectre be exploited from C#/.Net (or other managed languages or the Midori OS)?
First off yes the correct answer is patch your OS/system. That aside:
Does the memory managed features of a language like C# prevent it from being used to exploit the Meltdown security bug?
What ...
- 23
1
vote
1
answer
253
views
Can one sidestep Meltdown/Spectre vulnerabilities by not installing new software on a server?
Is it possible to not install new programs on a server and sidestep any Meltdown/Spectre vulnerabilities because it is only a newly identified issue.
I have an SLES server that runs a fixed database ...
- 113
3
votes
1
answer
373
views
Are MCUs (Like arduinos) effected by Meltdown?
I am curious if Microcontrolers are effected by the vulnerabilities of Meltdown and Spectre. These devices are not specifically CPUs, and do not run Operating Systems per-say. I'm not really sure I ...
- 301
8
votes
3
answers
2k
views
Why is accessing kernel memory a security risk?
A lot of the news regarding the Meltdown vulnerability is emphasizing that it allows programs to read memory that should be off limits to the user. While I understand that this should not happen, few ...
- 223
14
votes
3
answers
9k
views
Should Virtual Machines be patched for Meltdown and Spectre?
In Meltdown and Virtual Machines it was clarified that at least Spectre works crossing VMs. This of course means that the Hypervisor must be patched, but
Should the VM OS be patched as well?
Not ...
- 261
6
votes
3
answers
1k
views
Spectre and Meltdown being used in large scale attack on unpatched systems [closed]
Do we have to be worried about Spectre and Meltdown being used for a large scale attack like Wannacry? Even though the patches coming out are being deployed to a most recent systems, there will ...
- 201
11
votes
2
answers
647
views
Does recent Intel hardware mitigate Meltdown at the hardware level?
Recently a security researcher made the following claim via Twitter (emphasis added):
If you're running Windows, I'm about to publish a tool that checks if you have the "Variant 3: rogue data cache ...
- 8,834
3
votes
1
answer
280
views
Are Meltdown and Spectre complementary and used together
Meltdown and Spectre have both been announced at the same time, almost always in the same sentence. Is there a connection, other than timing and the fact that they attack chips? Are they used together ...
- 1,384
7
votes
2
answers
1k
views
Can Javascript engines that run on the JVM be used to implement the Spectre exploit?
I see that Chrome and Mozilla have added mitigations into their javascript engines for the Spectre vulnerabilities (CVE-2017-5753 & CVE-2017-5715). However I cant find anything regarding ...
- 173
171
votes
3
answers
17k
views
Meltdown and Spectre Attacks
Canonical question regarding the 2018 Jan. disclosed Meltdown and Spectre Attacks. Other identical or significantly similar questions should be closed as a duplicate of this one.
Main concerns
What ...
- 13.1k
2
votes
2
answers
828
views
Is there a microcode or other hardware fix for Meltdown?
Linked to my question here, the MS support page states
In addition to installing the January security update, a processor
microcode update is required.
But previous articles I've read said ...
- 194
0
votes
1
answer
100
views
Not to apply KPTI on servers that only run trusted code?
I have some servers that run applications that use IPC/RPC heavily and are sensitive to the delays of a syscall.
If this server is hardened to only run trusted code (e.g. automated code deployment ...
- 3,946
5
votes
2
answers
1k
views
Are VIA CPUs vulnerable to Spectre/Meltdown attacks?
I couldn't find any information about the recently published Spectre/Meltdown attacks affecting VIA CPUs.
Are they also affected by this vulnerabilities?
- 153
2
votes
2
answers
930
views
How are exploits like Meltdown and Spectre noticed? [closed]
From the brief research that I have done both Meltdown and Spectre were primarily found by the same person (Jann Horn (Google Project Zero)). How are such exploits normally noticed/found?
- 185
4
votes
1
answer
3k
views
Are Meltdown and Spectre exploitable on 32-bit Linux platforms?
All of the information I've seen thus far on Meltdown and Spectre explicitly reference 64-bit platforms. What about 32-bit (specifically RHEL/CentOS)? I would assume that's also vulnerable but can ...
- 3,448
6
votes
2
answers
629
views
Why do CPUs operate speculatively with results of forbidden memory fetches?
By my understanding, the Meltdown and Spectre attacks both exploit the fact that some modern processor, when given something like:
if (x < arr1[y])
z = arr2[arr3[x]*256];
may sometimes fetch ...
- 2,059
5
votes
1
answer
581
views
What was state of the art knowledge on security of speculative evaluation when it was introduced to Intel CPUs?
Many sources claim that almost all Intel x86 CPUs back to Pentium Pro are vulnerable to the Meltdown attack. Pentium Pro was introduced to the market in 1995.
What was the state of the art knowledge ...
- 161
26
votes
1
answer
8k
views
Meltdown and Virtual Machines
This question originated from a discussion about VMs not being vulnerable to Meltdown.
Can Meltdown "break out" of a virtual machine, so to speak?
What is meant by this is: Can a program (with any ...
- 1,024
4
votes
3
answers
970
views
Do the Spectre and Meltdown CPU bugs affect AMD in addition to Intel?
If a server or or PC is running AMD CPUs, will those be affected by the Spectre and/or Meltdown bugs currently effecting Intel chips?
Why or why not?
What makes it affect one and not the other? How ...
- 908
13
votes
1
answer
1k
views
Are Meltdown and Spectre only exploitable with compiled code?
Is a system vulnerable where the only untrusted code is interpreted, JIT'd, or executed in a VM as bytecode?
Does it depend on the language? Compiler?
Or, do attacks depend on the attacker loading ...
- 711
5
votes
1
answer
2k
views
Do I need to patch Linux for Meltdown/Spectre if the hypervisor has been patched, and I trust the guest?
If I'm running a VM on Amazon EC2 or Microsoft Azure, and they've patched the underlying hypervisor, do I need to upgrade my Linux kernel to protect against Meltdown or Spectre?
Assume that I'm not ...
- 2,337
4
votes
3
answers
2k
views
A POWER7 processor on IBM i is currently vulnerable to Meltdowm or Spectre [duplicate]
All the updates on available linux systems have already been made.
But I also have an IBM i (AS400) server, I have not heard in the news. But obviously it is more lucrative for news channels to ...
- 143
4
votes
3
answers
887
views
What do speculative execution patches protect me from?
There are a barrage of patches coming out, both at the application and OS levels for the recently disclosed speculative execution attacks against various vulnerabilities in CPUs from AMD, ARM, and ...
- 445
4
votes
1
answer
869
views
Can I disable access to JS APIs in the browser such as highres timers?
In the wake of recent news of CPU bugs like Meltdown and Spectre which rely on precise(-ish) measurments of elapsed time, I find myself in the mood for disabling things like window.performance.now() ...
- 161
48
votes
1
answer
9k
views
How to mitigate Meltdown in Docker images?
On https://meltdownattack.com/ it is suggested that (in some cases?) scenarios with Docker containers are also vulnerable.
I'm a developer using Docker for two different purposes:
Images used for ...
- 849
4
votes
2
answers
468
views
What is the relationship between the GPZ research titles and Meltdown and Spectre?
I learned today that there were three vulnerabilities reported by Google Project Zero: bounds check bypass, branch target injection and rogue cache data load. Here is the AMD response to them: https://...
- 273
68
votes
2
answers
10k
views
What are the risks of not patching a server or hypervisor for Meltdown?
The patch for Meltdown is rumoured to incur a 30% performance penalty, which would be nice to avoid if possible. So this becomes a Security vs Performance risk-assessment problem.
I am looking for a ...
- 58.8k
13
votes
1
answer
3k
views
How does Meltdown/Spectre impact Intel SGX?
I've been reading about Meltdown and Spectre today, and I'm wondering if they impact Intel SGX enclaves.
Now, my understanding of Meltdown is somewhat hazy, but AFAICT it does not impact secure ...
- 699
12
votes
1
answer
939
views
What are the risks of not patching a workstation OS for Meltdown?
Assume the following:
macOS (but not sure that matters that much)
workstation, mostly gets new executables from the app store or open source repos through macports homebrew
fair bit of loading JS, ...
1
vote
2
answers
535
views
How does the Intel CPU design flaw affect us? [closed]
Today, I saw this in the news. I'm hesitant to install the fix, because I've heard it would slow down IO 50%, which is not acceptable for me.
But a guy said that the flaw allows JavaScript in the ...
- 137
26
votes
6
answers
18k
views
How do I check if KPTI is enabled on linux?
The Meltdown attack FAQ says that KPTI is the fix for linux. How do I check if KPTI is running/enabled?
- 2,373
26
votes
1
answer
2k
views
Which attacks are known that exploit the vulnerability known as Spectre?
As reported yesterday the Linux and Windows kernels will receive a security update pretty soon to close vulnerabilities that concern 'kernel memory leaking'.
What exactly the design flaw is, that was ...
- 7,955