Meltdown (security vulnerability)

At the time of disclosure (2018), this included all devices running any but the most recent and patched versions of iOS,[5] Linux,[6][7] macOS,[5] or Windows.

[10] Meltdown was issued a Common Vulnerabilities and Exposures ID of CVE-2017-5754, also known as Rogue Data Cache Load (RDCL),[3] in January 2018.

[14] Several procedures to help protect home computers and related devices from the Meltdown and Spectre security vulnerabilities have been published.

[22] On 18 January 2018, unwanted reboots, even for newer Intel chips, due to Meltdown and Spectre patches, were reported.

[23] Nonetheless, according to Dell, "No 'real-world' exploits of these vulnerabilities [i.e., Meltdown and Spectre] have been reported to date [26 January 2018], though researchers have produced proof-of-concepts.

[26][27][28][29] On 8 October 2018, Intel is reported to have added hardware and firmware mitigations regarding Spectre and Meltdown vulnerabilities to its latest processors.

This can occur even if the original read instruction fails due to privilege checking, or if it never produces a readable result.

[citation needed] A Meltdown attack cannot be detected if it is carried out, as it does not leave any traces in traditional log files.

Put briefly, the instruction execution leaves side effects that constitute information not hidden to the process by the privilege check.

The process carrying out Meltdown then uses these side effects to infer the values of memory mapped data, bypassing the privilege check.

The specific impact depends on the implementation of the address translation mechanism in the OS and the underlying hardware architecture.

[72] A large portion of the then-current mid-range Android handsets use the Cortex-A53 or Cortex-A55 in an octa-core arrangement and are not affected by either the Meltdown or Spectre vulnerability as they do not perform out-of-order execution.

On 9 January 2018, Microsoft paused the distribution of the update to systems with affected CPUs while it investigated and addressed this bug.

[103][104] This is because the selective translation lookaside buffer (TLB) flushing enabled by PCID (also called address space number or ASN under the Alpha architecture) enables the shared TLB behavior crucial to the exploit to be isolated across processes, without constantly flushing the entire cache – the primary reason for the cost of mitigation.

A statement by Intel said that "any performance impacts are workload-dependent, and, for the average computer user, should not be significant and will be mitigated over time".

[21][20] Phoronix benchmarked several popular PC games on a Linux system with Intel's Coffee Lake Core i7-8700K CPU and KPTI patches installed, and found that any performance impact was small to non-existent.

[62] In other tests, including synthetic I/O benchmarks and databases such as PostgreSQL and Redis, an impact in performance was found, accounting even to tens of percent for some workloads.

[106] Several procedures to help protect home computers and related devices from the Meltdown and Spectre security vulnerabilities have been published.

[19][20][21] On 18 January 2018, unwanted reboots, even for newer Intel chips, due to Meltdown and Spectre patches, were reported.

[23] According to Dell, "No 'real-world' exploits of these vulnerabilities [ie, Meltdown and Spectre] have been reported to date [26 January 2018], though researchers have produced proof-of-concepts.

[108] On 8 October 2018, Intel was reported to have added hardware and firmware mitigations regarding Spectre and Meltdown vulnerabilities to its latest processors.