Friday, February 7, 2025
HomeSecurity NewsNearly Every CPU's Since 1995 are Vulnerable to "Meltdown" and "Spectre" Attacks

Nearly Every CPU’s Since 1995 are Vulnerable to “Meltdown” and “Spectre” Attacks

Published on

SIEM as a Service

Follow Us on Google News

A critical vulnerability published by Google which affects almost all the processors since 1995, the vulnerability resides in “speculative execution” a technique used by modern processors for processor optimization.

The hardware bugs Meltdown and Spectre allows an attacker to steal the data that currently processed on the computer it includes the process of personal photos, Emails, Password manager, instant messages and sensitive documents.

Security researchers from Google Project Zero discovered the vulnerability and it is similar to the bug reported in Intel Processors. Programs are not allowed to read other programs, Researchers says “a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs”.

What is Meltdown and Spectre

Meltdown breaks the separation between the user accounts and the operating systems, it allows access to the memory where attacker extract secret information from other programs and operating systems.

It breaks all security assumptions given by address space isolation as well as para-virtualized environments and, thus, every security mechanism building upon this foundation.There is no software vulnerability involved in Meltdown.

Spectre breaks the isolation between the applications, it allows an attacker to trick legitimate applications into leaking their secrets.

Spectre attacks involve inducing a victim to speculatively perform operations that would not occur during correct program execution and which leak the victim’s confidential information via a side channel to the adversary.

Devices Affected

The attack works on mobile devices, personal computers and cloud infrastructure depends on the cloud providers.

Antivirus won’t detect as like malware and it may detect may detect malware which uses the attacks by comparing binaries after they become known.

Meltdown affects Desktop, Laptop, and Cloud computers, it affects every processor starting from 1995 except Intel Itanium and Intel Atom before 2013. Researchers tested the exploits only with Intel processors at this time where as ARM and AMD processors are not tested.

Spectre affects Laptops, Smartphones, Desktops and Cloud Servers, it affects all the modern processors which keeps data on the flight, they have Intel, AMD, and ARM processors.

CVE in Reference

CVE-2017-5753 and CVE-2017-5715 are the references to Spectre, CVE-2017-5754 is for Meltdown Mitigation Spectre can be mitigated if speculative execution can be halted on potentially sensitive execution paths.

serialization instructions may not be an effective countermeasure on all processors or system configurations.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning...

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is...

Cybercriminals Target IIS Servers to Spread BadIIS Malware

A recent wave of cyberattacks has revealed the exploitation of Microsoft Internet Information Services...

Hackers Leveraging Image & Video Attachments to Deliver Malware

Cybercriminals are increasingly exploiting image and video files to deliver malware, leveraging advanced techniques...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

New FUD Malware Targets MacOS, Evading Antivirus and Security Tools

A new strain of Fully Undetectable (FUD) macOS malware, dubbed "Tiny FUD," has emerged,...

Google Blocks 2.28 Million Malicious Apps from Play Store in Security Crackdown

In a continued commitment to enhancing user safety and trust, Google has outlined significant...

Hackers Exploiting DNS Poisoning to Compromise Active Directory Environments

A groundbreaking technique for Kerberos relaying over HTTP, leveraging multicast poisoning, has been recently...