Spectre and Meltdown expose secrets through processor speculation
Researchers disclose processor attacks that infer protected memory through speculative execution, forcing operating-system, browser, cloud and chip vendors into coordinated mitigation work.
Google Project Zero researchers today described hardware vulnerabilities now known as Spectre and Meltdown. The attacks abuse speculative execution, a performance technique used by modern processors, to reveal information that software isolation should keep inaccessible.
Meltdown can cross the boundary between applications and operating-system memory on affected processors. Spectre tricks a victim program into leaking information through observable timing effects and is broader but harder to exploit. Neither problem resembles an ordinary software bug with one clean patch.
Operating-system and browser makers are issuing mitigations, while cloud operators must protect customers sharing physical machines. Some defenses may carry performance costs, and the range of affected devices will take time to establish. The disclosure challenges a basic assumption beneath computing: instructions discarded by the processor can still leave measurable traces. Hardware design, compiler behavior and software isolation must now be considered together rather than as separate security layers.
Source: Google Project Zero ↗