A critical vulnerability published by Google which affects almost all the processors since 1995, the vulnerability resides in “speculative execution” a technique used by modern processors for processor optimization.
The hardware bugs Meltdown and Spectre allows an attacker to steal the data that currently processed on the computer it includes the process of personal photos, Emails, Password manager, instant messages and sensitive documents.
Security researchers from Google Project Zero discovered the vulnerability and it is similar to the bug reported in Intel Processors. Programs are not allowed to read other programs, Researchers says “a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs”.
What is Meltdown and Spectre
Meltdown breaks the separation between the user accounts and the operating systems, it allows access to the memory where attacker extract secret information from other programs and operating systems.
It breaks all security assumptions given by address space isolation as well as para-virtualized environments and, thus, every security mechanism building upon this foundation.There is no software vulnerability involved in Meltdown.
Spectre breaks the isolation between the applications, it allows an attacker to trick legitimate applications into leaking their secrets.
Spectre attacks involve inducing a victim to speculatively perform operations that would not occur during correct program execution and which leak the victim’s confidential information via a side channel to the adversary.
Devices Affected
The attack works on mobile devices, personal computers and cloud infrastructure depends on the cloud providers.
Antivirus won’t detect as like malware and it may detect may detect malware which uses the attacks by comparing binaries after they become known.
Meltdown affects Desktop, Laptop, and Cloud computers, it affects every processor starting from 1995 except Intel Itanium and Intel Atom before 2013. Researchers tested the exploits only with Intel processors at this time where as ARM and AMD processors are not tested.
Spectre affects Laptops, Smartphones, Desktops and Cloud Servers, it affects all the modern processors which keeps data on the flight, they have Intel, AMD, and ARM processors.
CVE in Reference
CVE-2017-5753 and CVE-2017-5715 are the references to Spectre, CVE-2017-5754 is for Meltdown Mitigation Spectre can be mitigated if speculative execution can be halted on potentially sensitive execution paths.
serialization instructions may not be an effective countermeasure on all processors or system configurations.
