CPU main image

Vulnerabilities of the Modern CPU: Meltdown and Spectre cyber attacks explained

User Rating: 0 / 5

Star InactiveStar InactiveStar InactiveStar InactiveStar Inactive

Independently two vulnerabilities of the design of modern CPU chips has become public knowledge. The two attacks are called,

Meltdown - which melts the security protection that prevents user applications from accessing the system kernel memory

Spectre - which is a flaw in the speculative execution used in many modern CPUs where one application tricks another into accessing arbitrary locations in their memory

Both attacks expose a flaw in the hardware architectural design by using side channel attacks to obtain information from the accessed memory locations. In the case of Spectre notice that Paul Kocher the pioneering side channel attack agent from the 90's was involved along with other collaborators.

As always there are two questions, is it true and does it matter? Well it's certainly true and the scientists involved have reported the attacks in detail through the papers referenced below. Does it matter, yes, it does but that doesn't mean that anything untoward is about to happen on your computer or phone. In the first place you would need to install the associated malware on your device but of course the hackers are now totally alerted to the vulnerability. If you are operating in an absolute virtual machine environment then that will already protect the user application space from the system kernel memory space. However, typical systems are vulnerable and the core operating system developers are creating patches that will mitigate  against these vulnerabilities. It's really all about performance, modern chips do lots of things in advance not knowing whether the anticipated path will end up being followed. This leaves a trail that the hacker in this case has been able to expose.

I have a stronger view which is that it is impossible to perfectly protect any computing system from attack if its operation can be changed, i.e. any programmable device.

Dr David Everett


Metdown     https://meltdownattack.com/meltdown.pdf

Spectre       https://spectreattack.com/spectre.pdf


+44 (0) 1903 723 548

Microexpert Limited
Gratwicke House
10 East Street
West Sussex
BN17 6AW, UK

© 2018 Microexpert. Registered number 01755695.