ltechnologygroup.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to amazon.com.
Massive security vulnerabilities in modern CPUs are forcing a redesign of the kernel software at the heart of all major operating systems. Since the issues—dubbed Meltdown and Spectre—exist in the CPU hardware itself, Windows, Linux, Android, Macs, Chromebooks, and other operating systems all need to protect against it. And worse, it appears that plugging the hole will negatively affect your PC’s performance.
Everyday home users shouldn’t panic too much, though. Just apply the latest operating system updates and keep your antivirus software vigilant, as ever.
Here’s a high-level look at what you need to know about Meltdown and Spectre, in plain language. If you want a deep-dive into the technical details, be sure to read Google’s post on the CPU vulnerabilities. We’ve updated this article repeatedly as new information becomes available.
Meltdown and Spectre CPU flaw FAQ
Editor’s note: This article was most recently updated to include details about the firmware updates Intel is pushing out for recent processors, and Hardware Unboxed’s performance test results after applying the Windows patch.
Give it to me straight—what’s the issue here?
Again, the CPU exploits in play here are extremely technical, but in a nutshell, the exploit allows access to your operating system’s sacrosanct kernel memory because of how the processors handle “speculative execution,” which modern chips perform to increase performance. An attacker can exploit these CPU vulnerabilities to expose extremely sensitive data in your protected kernel memory, including passwords, cryptographic keys, personal photos, emails, or any other data on your PC.
Meltdown is the more serious exploit, and the one that operating systems are rushing to fix. It “breaks the most fundamental isolation between user applications and the operating system,” according to Google. This flaw most strongly affects Intel processors because of the aggressive way they handle speculative execution, though a few ARM cores are also susceptible.
Spectre affects AMD and ARM processors as well as Intel CPUs, which means mobile devices are at risk. (We have a separate FAQ on how Spectre affects phones and tablets.) It’s “harder to exploit than Meltdown, but it is also harder to mitigate,” Google says. There may be no hardware solution to Spectre, which “tricks other applications into accessing arbitrary locations in their memory.” Software needs to be hardened to guard against it.
What’s a kernel?
The kernel inside your operating system is basically an invisible process that facilitates the way apps and functions work on your computer, talking directly to the hardware. It has complete access to your operating system, with the highest possible level of permissions. Standard software has much more limited access. Here’s how The Register puts it: “Think of the kernel as God sitting on a cloud, looking down on Earth. It’s there, and no normal being can see it, yet they can pray to it.”
How do I know if my PC is at risk?
Short answer: It is. Probably.
Google says “effectively every” Intel processor released since 1995 is vulnerable to Meltdown, regardless of the OS you’re running or whether you have a desktop or laptop. Chips from Intel, AMD, and ARM are susceptible to Spectre attacks, though AMD says its hardware has “near zero” risk because of the way its chip architecture is designed.
Intel’s Core i7-8700K “Coffee Lake” CPU.
Intel said Thursday, though, that the patches that it is issuing—via firmware and operating system patches—“render those systems immune from both exploits.” That’s a big claim from Intel, and has yet to be confirmed. You can find a full list of affected Intel processors in this article.
So if Meltdown’s a chip problem, then Intel needs to fix it?
Yes and no. While Intel may address the fundamental hardware problem in future chips, the fix for PCs in the wild needs to come from the operating system manufacturer, as a microcode update alone won’t be able to properly repair it. Intel said on January 4 that it had been aware of both vulnerabilities since June 2017, which gives you an idea of how seriously the computing ecosystem has taken both Spectre and Meltdown.
Intel is also publishing firmware updates for its processors. You’ll need to snag them from your PC, laptop, or motherboard maker (like HP or Gigabyte) rather than Intel itself. Intel’s support page for the flaw links to firmware updates and information from the PC manufacturers it works with. By January 12, Intel expects to have released firmware updates for 90 percent of processors released in the past five years. The company hasn’t announced its plans for older CPUs like the venerable Core i7-2600K or processors from last decade.
So, what can I do?
Not much besides updating your PC with Meltdown patches issued by operating system makers. Since the issue is such a deeply technical one there isn’t anything users can do to mitigate the potential issue other than wait for a fix to arrive. Definitely make sure you’re running security software in the meantime—advice that Intel also stresses.
Do you know when a fix will come?
It’s already here for Windows, Mac, and Chromebook users.
Microsoft pushed out a Windows update protecting against Meltdown on January 3, the day that the CPU exploits hit headlines. Updates issued outside of Microsoft’s monthly “Patch Tuesdays” are rare, underlining the severity of this issue.
Apple quietly protected against Meltdown in macOS High Sierra 10.13.2, which released on December 6, according to developer Alex Ionescu. Additional safeguards will be found in macOS 10.13.3, he says. Kernel patches are also available for Linux.
Chromebooks received protection in Chrome OS 63, which released on December 15. Furthermore, the Chrome web browser itself was updated to include an opt-in experimental feature called “site isolation” that can help guard against Spectre attacks. Site isolation is trickier on mobile devices; Google warns that it can create “functionality and performance issues” in Android, and since Chrome on iOS is forced to use Apple’s WKWebView, Spectre protections on that platform need to come from Apple itself. Chrome 64 will include more mitigations.
Mozilla and Microsoft are taking steps to protect browsers against Spectre as well. Firefox 57 released in November with some initial safeguards, and Edge and Internet Explorer received an update alongside Windows 10.
So once I download the Meltdown patch then I’m good?
Well, the operating system patches will plug the risk of Meltdown, but you might not like the side effects. While the fix will prevent the chip’s kernel from leaking memory, it brings some unfortunate changes to the way the OS interacts with the processor. And that could lead to slowdowns.
How much slower will my PC or Mac become?
It’s complicated. Fortunately, a growing number of tests seem to support Intel’s contention that everyday PC users won’t see dramatic slowdowns, although there’s one particular area of concern: drive read performace.
More recent Intel processors from the Haswell (4th-gen) era onward have a technology called PCID (Process-Context Identifiers) enabled and are said to suffer less of a performance hit. Plus, some applications—most notably virtualization tasks and data center/cloud workloads—are affected more than others. Intel confirmed that the performance loss will be dependent on workload, and “should not be significant” for average home computer users.
Intel processors have a severe kernel security flaw.
“Obviously it depends on just exactly what you do,” Linux creator Linus Torvalds wrote in the Linux Kernel Mailing List. “Some loads will hardly be affected at all, if they just spend all their time in user space. And if you do a lot of small system calls, you might see double-digit slowdown.”
Michael Larabel, the open-source guru behind the Linux-centric Phoronix website, has run a gauntlet of benchmarks using Linux 4.15-rc6, an early release candidate build of the upcoming Linux 4.15 kernel. It includes the new Linux KPTI protections for the Intel CPU kernel flaw. The Core i7-8700K saw a massive performance decrease in FS-Mark 3.3 and Compile Bench, a pair of synthetic I/O benchmarks. PostgreSQL and Redis suffered a loss, but to a far lesser degree. Finally, H.264 video encoding, timed Linux kernel compilation, and FFmpeg video conversion tasks didn’t lose anything.
Hardware Unboxed—a superb PC hardware channel on YouTube—ran tests of several different application types after applying the Windows 10 patch and the biggest performance hits occurred when moving data around on SSDs, mirroring Phoronix’s findings. Many applications showed little to no performance change with the Meltdown patch applied, including Cinebench and 7-Zip, two CPU-focused benchmarks.
Likewise, TechSpot’s battery of tests run before and after patching Windows appears to indicate insignificant changes across a range of synthetic benchmarks and several games. Again, problems arose when TechSpot tested 4K read operations from SSDs, where performance dropped by 23 percent. Incidentally, as PCWorld’s Gordon Mah Ung pointed out, 4K reads are exactly what another Intel product—Optane—excels at.
Will my games get slower?
Probably not. Phoronix also tested Dota 2, Counter-Strike: Global Offensive, Deus Ex: Mankind Divided, Dawn of War III, F1 2017, and The Talos Principle on a Linux 4.15-rc6 machine with a Core i7-8700K and Radeon Vega 64. None saw a frame rate change outside the margin of error range.
Hardware Unboxed tested a handful of DirectX-based Windows games in the video linked above. With DirectX hooking so deeply into Windows, gamers were worried about a potential performance degradation there. Fortunately, Hardware Unboxed observed virtually no frame rate loss in Ashes of the Singularity, Assassin’s Creed: Origins, or Battlefield 1. Phew.
Are AMD processors affected?
Much, much less than Intel chips. All modern CPUs are vulnerable to Spectre attacks, but AMD says that its CPUs have “near zero” risk to one variant due to the way they’re constructed. The performance impact of Spectre patches are expected to be “negligible.”
There is “zero AMD vulnerability” to Meltdown thanks to chip design, AMD says. If operating system patches exclude AMD CPUs from the new Meltdown restrictions, the performance war between Intel’s chips and AMD’s new Ryzen CPUs may get even tighter.
That sucks! There’s nothing I can do!?
We feel your pain. But security trumps performance, so we’d rather our PCs be a little slower than exposed to hackers.
At L Technology Group, we know technology alone will not protect us from the risks associated with in cyberspace. Hackers, Nation States like Russia and China along with “Bob” in HR opening that email, are all real threats to your organization. Defending against these threats requires a new strategy that incorporates not only technology, but also intelligent personnel who, eats and breaths cybersecurity. Together with proven processes and techniques combines for an advanced next-generation security solution. Since 2008 L Technology Group has develop people, processes and technology to combat the ever changing threat landscape that businesses face day to day.
Call Toll Free (855) 999-6425 for a FREE Consultation from L Technology Group, https://www.ltechnologygroup.com.