Meltdown (security vulnerability)

Lore & Background

Meltdown exploits a race condition inherent in the design of many modern CPUs, occurring between memory access and privilege checking during instruction processing. Combined with a cache side-channel attack, it allows a process to bypass normal privilege checks that isolate it from accessing data belonging to the operating system and other running processes. Because affected processors implement instruction pipelining, data from an unauthorized address is almost always temporarily loaded into the CPU's cache during out-of-order execution, from which it can be recovered even if the original read instruction fails due to privilege checking. Since many operating systems map physical memory, kernel processes, and other running user space processes into the address space of every process, Meltdown effectively makes it possible for a rogue process to read any physical, kernel, or other processes' mapped memory. The vulnerability is viable on any operating system where privileged data is mapped into virtual memory for unprivileged processes, which includes many present-day operating systems. A Meltdown attack cannot be detected if carried out, as it leaves no traces in traditional log files.

Reader's Guide

Meltdown was discovered independently by Jann Horn from Google's Project Zero, Werner Haas and Thomas Prescher from Cyberus Technology, and Daniel Gruss, Moritz Lipp, Stefan Mangard and Michael Schwarz from Graz University of Technology. The same research teams also discovered Spectre. The vulnerability was called Meltdown because 'the vulnerability basically melts security boundaries which are normally enforced by the hardware'. At the time of disclosure in 2018, it affected all devices running any but the most recent and patched versions of iOS, Linux, macOS, or Windows, impacting many servers, cloud services, and a potential majority of smart devices and embedded devices using ARM-based processors. A purely software workaround was assessed as slowing computers between 5 and 30 percent in certain specialized workloads, though companies responsible for software correction reported minimal impact from general benchmark testing. On 15 March 2018, Intel reported it would redesign its CPUs to help protect against Meltdown and related Spectre vulnerabilities, and on 8 October 2018, Intel was reported to have added hardware and firmware mitigations to its latest processors. Dell stated that no 'real-world' exploits had been reported as of 26 January 2018, though researchers had produced proof-of-concepts.

Did You Know?

• Meltdown was discovered independently by researchers at Google's Project Zero, Cyberus Technology, and Graz University of Technology.
• The vulnerability was named Meltdown because it 'melts security boundaries which are normally enforced by the hardware'.