This presentation is a collection of available information that has been organized to fill in gaps for professionals wanting to understand the Spectre and Meltdown vulnerabilities and associated threats.

1. Spectre & Meltdown
Dr. Shawn P. Murray, C|CISO, CISSP, CRISC, FITSP-A, C|ND
ISSA Colorado Springs Chapter, Training Meetings, January 2018

2. Spectre & Meltdown - Agenda
• What are they?
• What are the issues?
• What is the risk?
• Who discovered them?
• Who is affected?
• Patches, Updates, Notices & Advisories
• What should you do?
• Resources
• Questions?

3. Spectre & Meltdown
What are they?
Spectre
• Spectre breaks the isolation between different applications.
• Allows an attacker to trick error-free applications, which follow best practices, into
leaking their secrets.
• The safety checks of said best practices actually increase the attack surface and may
make applications more susceptible to Spectre
Meltdown
• Meltdown breaks the most fundamental isolation between user applications and the
operating system.
• This attack allows a program to access the memory, and thus also the secrets, of other
programs and the operating system.

4. Spectre & Meltdown
What are they?
What are the differences?
What is the difference between Meltdown and Spectre?
• Spectre tricks other applications into accessing arbitrary locations in their
memory.
• Both attacks use side channels to obtain the information from the accessed memory
location.
• Meltdown breaks the mechanism that keeps applications from accessing
arbitrary system memory.
• Consequently, applications can access system memory.

5. Meltdown
What are the issues?
“One of the central security features of today’s operating systems is memory isolation.
Operating systems ensure that user applications cannot access each other’s memories and
prevent user applications from reading or writing kernel memory.
This isolation is a cornerstone of our computing environments and allows running multiple
applications on personal devices or executing processes of multiple users on a single
machine in the cloud.”
“Meltdown is a novel attack that allows overcoming memory isolation completely by
providing a simple way for any user process to read the entire kernel memory of the
machine it executes on, including all physical memory mapped in the kernel region.
Meltdown does not exploit any software vulnerability, i.e., it works on all major operating
systems. Instead, Meltdown exploits side-channel information available on most modern
processors, e.g., modern Intel microarchitectures since 2010 and potentially on other CPUs
of other vendors.”

6. While side-channel attacks typically require very specific knowledge about the target
application and are tailored to only leak information about its secrets, Meltdown
allows an adversary who can run code on the vulnerable processor to obtain a dump
of the entire kernel address space, including any mapped physical memory.
The root cause of the simplicity and strength of Meltdown are side effects caused by
out-of-order execution.”
“Out-of-order execution is an important performance feature of today’s processors in
order to overcome latencies of busy execution units, e.g., a memory fetch unit needs
to wait for data arrival from memory.
Instead of stalling the execution, modern processors run operations out-of-order i.e.,
they look ahead and schedule subsequent operations to idle execution units of the
processor.”
PERFORMANCE BEFORE SECURITY!!!
Meltdown
What are the issues?

7. Meltdown
What are the issues?
“The Meltdown attack uses exception
handling or suppression, e.g., TSX, to run a
series of transient instructions.
These transient instructions obtain a
(persistent) secret value and change the
microarchitectural state of the processor
based on this secret value.
This forms the sending part of a
microarchitectural covert channel.
The receiving side reads the
microarchitectural state, making it
architectural and recovering the secret
value.”

8. Spectre
What are the issues?
“Modern processors use branch prediction and speculative execution to maximize
performance.
For example, if the destination of a branch depends on a memory value that is in the
process of being read, CPUs will try guess the destination and attempt to execute
ahead. When the memory value finally arrives, the CPU either discards or commits the
speculative computation.
Speculative logic is unfaithful in how it executes, can access to the victim’s memory
and registers, and can perform operations with measurable side effects.
Spectre attacks involve inducing a victim to speculatively perform operations that
would not occur during correct program execution and which leak the victim’s
confidential information via a side channel to the adversary.”

9. Spectre
What are the issues?
“Speculative execution is a technique used by high speed processors in order to increase
performance by guessing likely future execution paths and prematurely executing the
instructions in them.
For example when the program’s control flow depends on an uncached value located in the
physical memory, it may take several hundred clock cycles before the value becomes
known. Rather than wasting these cycles by idling, the processor guesses the direction of
control flow, saves a checkpoint of its register state, and proceeds to speculatively execute
the program on the guessed path.
When the value eventually arrives from memory the processor checks the correctness of its
initial guess. If the guess was wrong, the processor discards the (incorrect) speculative
execution by reverting the register state back to the stored checkpoint, resulting in
performance comparable to idling.
In case the guess was correct, however, the speculative execution results are committed,
yielding a significant performance gain as useful work was accomplished during the delay.”
PERFORMANCE OVER SECURITY!!

10. Spectre & Meltdown
What is the risk?
According to TECHI.ES
• Meltdown and Spectre exploit critical vulnerabilities in modern processors.
• These hardware bugs allow programs to steal data which is currently processed on the computer.
• While programs are typically not permitted to read data from other programs, a malicious program can exploit
Meltdown and Spectre to get hold of secrets stored in the memory of other running programs.
• This might include:
• passwords stored in a password manager or browser,
• your personal photos,
• Emails & instant messages
• business-critical documents.
• Meltdown and Spectre work on personal computers, mobile devices, and in the cloud. Depending on the cloud
provider’s infrastructure, it might be possible to steal data from other customers.

11. Spectre & Meltdown
Who discovered them?
Spectre was independently discovered and reported by two people:
• Jann Horn (Google Project Zero) and
• Paul Kocher in collaboration with: (in alphabetical order),
• Daniel Genkin (University of Pennsylvania and University of Maryland),
• Mike Hamburg (Rambus),
• Moritz Lipp (Graz University of Technology), and
• Yuval Yarom (University of Adelaide and Data61)
Meltdown was independently discovered and reported by three teams:
• Jann Horn (Google Project Zero),
• Werner Haas, Thomas Prescher (Cyberus Technology),
• Daniel Gruss, Moritz Lipp, Stefan Mangard, Michael Schwarz (Graz University of Technology)

12. Spectre & Meltdown
Who is affected?
• Almost Everyone!
Which systems are affected by Meltdown?
• Many Desktop, Laptop, and Cloud computers may be affected by Meltdown.
• More technically, every Intel processor which implements out-of-order execution is potentially affected, which
is effectively every processor since 1995
• (Does not apply to Intel Itanium and Intel Atom before 2013).
• The team successfully tested Meltdown on Intel processor generations released as early as 2011.
• Currently, we have only verified Meltdown on Intel processors.
• At the moment, it is unclear whether AMD processors are also affected by Meltdown.
• According to ARM, some of their processors are also affected.

13. Spectre & Meltdown
Who is affected?
• Almost Everyone!
Which cloud providers are affected by Meltdown?
• Cloud providers which use:
• Intel CPUs and;
• Xen PV as virtualization without having patches applied.
• Also cloud providers without real hardware virtualization,
• They rely on containers that share one kernel, such as:
• Docker,
• LXC, or
• OpenVZ

14. Spectre & Meltdown
Who is affected?
• Almost Everyone!
Which systems are affected by Spectre?
• Almost every system is affected by Spectre:
• Desktops,
• Laptops,
• Cloud Servers,
• Smartphones.
• More specifically, all modern processors capable of keeping many instructions in flight are potentially
vulnerable.
• In particular, the discovery team have verified Spectre on Intel, AMD, and ARM processors.

15. Spectre & Meltdown
Patches, Updates, Notices & Advisories
What are CVE-2017-5753 and CVE-2017-5715?
CVE-2017-5753 and CVE-2017-5715 are the official references to
Spectre.
What is the CVE-2017-5754?
CVE-2017-5754 is the official reference to Meltdown.
Common Vulnerabilities & Exposures is the Standard for Information Security Vulnerability
Names maintained by MITRE.

16. Spectre & Meltdown
Patches, Updates, Notices & Advisories
Where can I find official information or security advisories of involved/affected companies?
Intel
ARM
AMD
RISC-V
NVIDIA
Microsoft
Amazon
Google
Android
Apple
Lenovo
IBM
Dell
Hewlett Packard Enterprise
HP Inc.
Huawei
Synology
Security Advisory / Newsroom / Whitepaper
Security Update
Security Information
Blog
Security Bulletin / Product Security
Security Guidance / Information regarding anti-virus software / Azure Blog / Windows (Client) / Windows (Server)
Security Bulletin
Project Zero Blog / Need to know
Security Bulletin
Apple Support
Security Advisory
Blog
Knowledge Base / Knowledge Base (Server)
Vulnerability Alert
Security Bulletin
Security Notice
Security Advisory

17. Spectre & Meltdown
Patches, Updates, Notices & Advisories
Where can I find official information or security advisories of involved/affected companies?
Cisco
F5
Mozilla
Red Hat
Debian
Ubuntu
SUSE
Fedora
Qubes
Fortinet
NetApp
LLVM
CERT
MITRE
VMWare
Citrix
Xen
Security Advisory
Security Advisory
Security Blog
Vulnerability Response / Performance Impacts
Security Tracker
Knowledge Base
Vulnerability Response
Kernel update
Announcement
Advisory
Advisory
Spectre (Variant #2) Patch / Review builtin_load_no_speculate / Review llvm.nospeculateload
Vulnerability Note
CVE-2017-5715 / CVE-2017-5753 / CVE-2017-5754
Security Advisory / Blog
Security Bulletin / Security Bulletin (XenServer)
Security Advisory (XSA-254) / FAQ

18. Spectre & Meltdown
What should you do?
• Get with your hardware and software vendors to see which patches and/or
updates are recommended.
• Some application and OS patches are creating problems for users once they reboot.
• Suggest a thorough backup of all files that the user doesn’t want to lose before
installing patches
• For cloud services, check with your provided to see if they run the affected chips
that make them vulnerable
• Check your contract and SLA for data sanitization and backup
• Leakage less of a risk for dedicated cloud services
• More of a risk for shared services
• Most Mobile device manufacturers have developed patches as well
• Ensure you back up your device and files before applying any updates

19. Most Common Questions & Answers can be
attained from the Official Site
https://meltdownattack.com/
There is additional technical information about Meltdown and Spectre on the
official website.
They have posted an academic paper and a blog post about Meltdown, and an
academic paper about Spectre.
There is also a link to the Google Project Zero blog about both attacks.

20. Questions?
Meltdown
Spectre

21. Resources
• Spectre & Meltdown official website
• https://meltdownattack.com/
• Meltdown and Spectre exploit critical vulnerabilities in modern processors
• http://www.techi.es/meltdown-and-spectre-exploit-critical-vulnerabilities-in-modern-processors/
• Spectre Attack Paper
• https://spectreattack.com/spectre.pdf
• Meltdown Attack Paper
• https://meltdownattack.com/meltdown.pdf
• Microsoft puts update fixing Meltdown, Spectre flaws on hold as some AMD PCs become
unbootable
• https://www.digit.in/security-software/microsoft-update-fixing-meltdown-spectre-flaws-put-on-hold-as-some-
amd-pcs-become-unbootable-39053.html

22. • https://www.clever-cloud.com/blog/img/medias/spectre-meltdown.jpg
• https://i2.wp.com/chromeunboxed.com/wp-content/uploads/2018/01/spectreMeltdownChromebooks.jpeg?fit=1200%2C606&ssl=1
• https://betanews.com/wp-content/uploads/2018/01/intel-processor.jpg
• https://www.blogcdn.com/www.engadget.com/media/2008/07/7-25-08-nvidia_geforce_9m_9600m_gt.jpg
• https://www.ginjfo.com/wp-content/uploads/2015/04/LinuxKernel_01-620x330.jpg
• https://upload.wikimedia.org/wikipedia/commons/d/de/Ic-photo-AMD--AMD-K6-166ALR-(K6-CPU).jpg
• https://techviral.net/wp-content/uploads/2018/01/Here-Is-The-List-Of-Intel-CPUs-Affected-By-Spectre-Meltdown.png
• https://www.servethehome.com/wp-content/uploads/2018/01/FreeBSD.jpg
• http://editorial.designtaxi.com/editorial-images/news-ShieldSpectreMeltdownFlaws080118/1-Apple-Google-Microsoft-Spectre-Meltdown-Flaws-Gadgets.jpg
• https://biztechmagazine.com/sites/default/files/articles/BizTech/201801/Spectre_Meltdown_3c.jpg
• https://i-cdn.phonearena.com/images/article/101314-image/Apple-says-iOS-is-vulnerable-to-Meltdown-and-Spectre-issues.jpg
• http://www.techi.es/wp-content/uploads/2017/06/Data-breach-public-site-image-2-678x390.jpg
• http://resellermalaysia.my/wp-content/uploads/2018/01/CPU-Meltdown-Spectre-e1515481679130-702x336.png
Images Credit