Meltdown is a security vulnerability published in 2018 together with Spectre. It is due to a vulnerability in the hardware architecture of processors and allows unauthorized reading of the memory contents of third-party processes. Processors from various manufacturers such as x86 processors from Intel are affected. Software patches to fix the problem cause performance degradation.
Contents
What is Meltdown?
Meltdown is an attack scenario on a vulnerability in the hardware architecture of microprocessors discovered in 2017 and published in 2018. Meltdown was found and published along with the Spectre attack scenarios by researchers from various European universities and Google’s Project Zero.
By exploiting the vulnerability, memory contents of third-party processes can be read without authorization. It is important to note that the term “Meltdown” is not the actual name of the vulnerability, but the name of an attack vector to exploit the vulnerability.
After the first publication of the vulnerability, further Meltdown attack scenarios became known. The majority of x86 processors offered by Intel in recent years and processors with ARM or POWER architecture from other manufacturers are affected by the vulnerability.
Processors from the manufacturer AMD were not vulnerable to initial Meltdown attack scenarios. Due to the fact that it is a problem in the hardware architecture of the processors, the vulnerability affects a wide variety of computers and systems such as PCs, laptops, smartphones, tablets, or servers with different operating systems such as Windows, Linux, Android, macOS or iOS. Software patches can minimize the risk of exploiting the vulnerability. Basically, the problem is eliminated on systems equipped with Meltdown-resistant processors of the latest generation.
Affected systems
Because the processors affected by the vulnerability are present in many of the PCs, laptops, smartphones, tablets, and servers produced in the last 20 years, a wide range of systems are vulnerable to the problem regardless of their operating system. Manufacturers of affected processors include Intel, IBM, Apple, Qualcomm, and others.
Processors made by AMD were not vulnerable to initial Meltdown attack scenarios. However, Spectre attack scenarios also work on numerous AMD processors. The flaw in the hardware architecture affects various operating systems like Linux, Windows, Android, iOS, macOS, or FreeBSD and software like web browsers.
Technical background of the vulnerability
A majority of processors available on the market in the last two decades use so-called out-of-order execution to increase performance. Out-of-order execution allows machine instructions to be executed in a different order than listed in the program code. The computing units of a processor can be better utilized in this way.
By skillful manipulation of this behavior accesses to memory contents of strange processes become possible. Contents of memory cells can be read and processed, although calling processes actually have no rights for these memory sections. Meltdown is based on a side-channel attack that allows conclusions to be drawn about the contents of a memory area by evaluating runtime behavior during access.
Measures to protect against Meltdown
Since replacing processors is usually out of the question for systems affected by the vulnerability, attempts are being made to fix the problem with the operating system and software patches. However, these patches do not provide one hundred percent protection. This can basically only be achieved without performance losses with Meltdown protection on the hardware level.
The latest processor generations (some already from 2019) from various manufacturers offer Meltdown and Spectre protection at the hardware level. Microcode updates exist for some older processors to fix the problems. Patches on the software level basically lead to performance losses on the systems.
Information Security Asia is the go-to website for the latest cybersecurity and tech news in various sectors. Our expert writers provide insights and analysis that you can trust, so you can stay ahead of the curve and protect your business. Whether you are a small business, an enterprise or even a government agency, we have the latest updates and advice for all aspects of cybersecurity.
