University Report: Meltdown and Spectre Vulnerability Analysis

This report provides a detailed analysis of the Meltdown and Spectre vulnerabilities, two processor-level flaws that affect various operating systems, including Windows, Linux, Android, MacOS, and iOS. It explains the vulnerabilities, which exploit speculative execution and branch prediction features in modern processors, and highlights the differences between Meltdown and Spectre. The report delves into the mechanisms of these attacks, including side-channel timing attacks and cache exploitation, and discusses their potential impacts. It then evaluates available countermeasures, such as security patches and kernel page table isolation (KPTI), and examines future impacts. The report concludes with recommendations for mitigating the vulnerabilities and ensuring system security. The content is contributed by a student to be published on the website Desklib, a platform which provides all the necessary AI based study tools for students.

Running head: MELTDOWN AND SPECTRE
MELTDOWN AND SPECTRE
Name of the University
Name of the Student
Author Note

1MELTDOWN AND SPECTRE
Table of Contents
Introduction................................................................................................................................2
Aim of the report....................................................................................................................2
Scope of the report.................................................................................................................3
Discussion..................................................................................................................................3
About Spectre.........................................................................................................................3
About Meltdown....................................................................................................................5
Counter measures to Spectre and Meltdown..........................................................................7
Future Impacts of Spectre and Meltdown..............................................................................9
Conclusions..............................................................................................................................11
References................................................................................................................................13
Introduction

2MELTDOWN AND SPECTRE
Cyber security researcher have highlighted two processor level flaws named as
Spectre and Meltdown. Almost all operating systems such as Windows, Linux, Android,
MacOS and iOS are affected by these vulnerabilities. The researchers have proposed that
these vulnerabilities are occurring due to a feature named as Speculative execution which is
present in most of the processors used nowadays.
According to Apple, the vulnerabilities cannot exploit data if a malicious software is
not present in the affected system. According to Project Zero run by Google, the attackers
needs to have physical access to the device before running the vulnerabilities. Till now, most
of the companies have denied any allegation that these vulnerabilities have been used to
extrapolate sensitive information from consumer devices but Project Zero had already shown
a working example of the attack which was used to cripple an entire server network. Apple
has accepted that out of the two attacks meltdown has more potential to cause damage. As
many devices do not support updates any more, this puts a lot of people at risk immediately.
According to a security blog by Google, the devices with latest security updates are safe from
this vulnerability (Gruss et al. 2016). Both of the vulnerabilities use speculative execution but
the main difference between the two is that where Meltdown exploits Intel privilege
escalation, Spectre exploits two processes in combination namely Branch Prediction and
Speculative Execution.
In the following report, the details about Spectre and Meltdown has been discussed in
details and possible mitigation techniques have been proposed.
Aim of the report
The aim of the report is written as follows:-
 Analyse the threats from Spectre and Meltdown

3MELTDOWN AND SPECTRE
 Evaluate the security techniques and policies that are implemented for combating the
vulnerabilities
 Predicting the future impact of the vulnerabilities
 Recommend counter measures to Meltdown and Spectre
Scope of the report
The scope of the report is to provide a detailed analysis to researchers for
understanding the threats and create proper preventive measures to combat these issues.
Discussion
About Spectre
The vulnerability named Spectre utilizes random locations in the memory space of the
program to trick other programs. The contents of the accessed memory space can be looked
up by the potential attacker to gather sensitive data. The spectre is a list of vulnerabilities
instead of a single vulnerability and are related to the speculative execution exploit. To be
precise, Spectre runs on a special case of speculative execution known as branch prediction
(Hruska 2018). It does not rely on the memory management of a single processor which
makes it different form the other vulnerability called Meltdown. The initiation point of the
attack is triggered by a side channel timing attack in the modern microprocessors and utilizes
its branch prediction machinery. Even after the vulnerability is mitigated, the side effects of
the speculative execution can leave side effects such as loaded cache lines. The non-
functional elements of the computing environment can be affected due to this.
To understand about spectre, the working of a microprocessor needs to be understood.
Suppose a simple program is present which adds two variables x and y. In order to execute

4MELTDOWN AND SPECTRE
the processor has to perform four basic things. First it needs to load the value of x from the
main memory into the processor (here into a register called R1). Same thing happens to
variable y which goes into register R2. The processor then adds the two values together and
stores the result in R1. Then the computer needs to simply store R1 back to the main memory
to complete the program (Lipp et al. 2016). As the processor is really fast and the main
memory is slow, processor designers add a number of features to hide this discrepancies.
One feature is known as cache and the other feature is known as speculation and
Spectre uses this two features in combination to leak secret data to people who are not
supposed to have it. Caches are small memories that are much faster than main memory
which can be used to store frequently used values. The values of X and Y can be updated in
the cache so the need to write back the values in the slow main memory can be avoided
which results in faster execution of the program. This difference in access speeds is exploited
by Spectre vulnerability to track data (Trippel, Lustig and Martonosi 2018).
The Spectre vulnerability is based on two major flaws. First, the logic of branch
prediction can be trained to hit a program’s internal workings. Second, it shows that a non-
functional difference can be moved to a covert channel which can collect personal
information from the inner workings of a processor.
The spectre vulnerability is remotely accessible. All the user has to do is to visit the
website containing the spectre code and the leaking of sensitive information starts instantly
from the browser such as passwords and cookies. To make matters worse, it is not a software
vulnerability but a hardware bug and no software workarounds can be dispatched to erase it.
Intel has released a micro code to reduce exposure to the bug but it does not eliminate it
entirely. The bug relies on caching and speculation as the primary means to extract data and
the problem is that this feature has been present in most processors that are used in

5MELTDOWN AND SPECTRE
performance sensitive systems (laptops, smartphones and servers in clouds). This makes all
the devices a potential candidate for the vulnerability (Theregister.co.uk 2018). Without
entirely removing speculation or caching (which can cause systems to slow down), it is still
unclear if the vulnerability can be removed at all.
About Meltdown
Meltdown specifically attacks the Intel x86 Microprocessors, ARM Microprocessors
and IBM processors. It breaks the fundamental wall between the operating system and user
applications. It allows a program to access memory which is extremely dangerous. The
vulnerability is hardware based and gives permission to a rogue process to read memory
without authentication. AMD processors are not affected by this vulnerability. Any Intel
processors that were made in the last 10 years are potentially vulnerable to the attack. The
vulnerability exploits a race condition of the CPU that happens between privilege checking
and instruction execution (Griffin 2018). Before the privilege check can occur, it reads the
unauthorised mapped data in a normal way.
step 1
Processor
loads secret
data but
blocks
access
step 2
Processor
indexes
array under
attacker
control
using secret
code
step 3
Atacker
observes
cache
timing to
extract
secret code

6MELTDOWN AND SPECTRE
Figure 1: How Meltdown works
(Source: Created by the author)
Meltdown convinces the processor to load some secret data. The
processor is eventually going to block this access and not allow the attacking process to see
the results explicitly in registers or in memory that’s under the attacker’s control. However in
step 2 of the attack the attacker convinces the processor to index the array that is under the
attacker control using the data that was loaded in step 1 and then the attacker observes the
timing differences between the accesses to this array in order to extract the secret data even
though the processor didn’t explicitly load it. Step 2 and 3 are known as cache side channel
attack. Meltdown specifically uses flush reload side channel attack (Kocher et al. 2018). The
way this work is that first the vulnerability clears the processor cache through flush operation.
The next step is to trick the processor into loading a particular element of an array under the
attackers control using secret data. This access causes the processor to load into the cache the
element of the rogue array (O'Donnell et al. 2018). The attacker then observes the array and
observes the amount of time to make each access very reliably. Step 1 is very important to
Meltdown as it gives the vulnerability access to the kernel.
The kernel is the heart of the operating system and controls the
hardware by authenticating who gets access to which memory slot. Meltdown computes the
kernel address and asks the processor to load it through speculative process in a register
(Fruhlinger 2018). Before loading the kernel data in the register from the main memory, the
data is saved temporarily in the cache memory present in the processor. This data is then
exploited by the attacker to get the access time of kernel data without any privileges. The
kernel data leakage contains sensitive information such as contents of files that were recently
read. The vulnerability creates a virtual environment inside the physical memory and the

7MELTDOWN AND SPECTRE
attacker gets to move exploit data whenever he wants (Simakov et al. 2018). Therefore, any
program which is running in the user context can force the CPU to collect data in the caches
through speculative execution and use it as an Oracle database to trickle Kernel data by
bypassing the operating system’s standard controls.
Counter measures to Spectre and Meltdown
As the vulnerability is fundamentally present at the hardware level, a complete
patch is not possible. But security patches that work around the vulnerability are released by
several vendors like Apple, Microsoft and Google. For Linux operating system, the KAISER
patch that was incidentally released in 2017 prevents the Meltdown vulnerability but provides
little security for Spectre. Cloud servers are being patched to protect them from the
vulnerabilities. Rendition Infosec has provided a strategy for organizations about how they
can protect their systems from potential damage from the vulnerabilities (Gras et al. 2014).
Keeping the browsers updated is essential as Spectre normally uses JavaScript to conduct its
malicious activities. Protection of older operating systems such as Windows XP are not
possible. Similarly older android operating systems or budget phones are exempted from
getting any software updates for the issue (Support.microsoft.com 2018).
Microsoft has released several system patches for its operating systems like
Windows 7 and up. It also patches the edge and explorer browsers. Firmware updates have
been provided as well for all the major processor manufacturers including AMD. Some
patches were not working with AMD so they have been temporarily removed. The patches
were released from 11th January (Benger et al. 2014).
On January 3rd, Apple released similar patches for its operating systems namely
MacOS, TvOS and iOS as well as its Safari browsers (Meltdownattack.com 2018).

8MELTDOWN AND SPECTRE
Although ChromeOS is not affected as much as other operating systems, Google
has released patches for some of its chromebooks too.
Firefox also has a patch ready for its browser on January 23rd whose beta version
can be downloaded now.
To mitigate Meltdown, the memory management between the operating system and
the application software needs to be fundamentally changed. Kernel page table isolation or
KPTI is a technology which makes sure that secure data cannot be loaded in the internal
caches of a microchip when the user code is running. KPTI takes some extra steps when an
application software asks the operating system to do something for the software. Apple has
also released mitigation updates in iOS 13.2, 11.2 and 10. Microsoft has released software
patches that are incompatible with antivirus programmes that use kernels calls which are
unsupported. As Meltdown involves no software vulnerability, mist of the software patches
will leave a little amount of memory exposed. It can be prevented by serializing the register
fetch and permission check (Lipp et al. 2018). This process however imposes a lot of
overhead to memory addresses stalling the fetching process sometimes.
A better mitigation process would be to provide a hard split between the kernel
space and the user space. Introducing a new kernel bit in the control register of the CPU can
be enabled by modern kernels. The kernel has to stay in the upper part of the address space
when the hard split bit is set. This will enable the system to identify an unauthorized memory
fetch which is violating the security boundary of the privilege level (Azab et al. 2014). The
performance impact is expected to be minimal (around 10 percent). Another countermeasure
that can be imposed for Meltdown is introducing KAISER (a modified kernel where the
kernel is situated outside the user space). It prevent Meltdown by not providing any valid
mapping space to physical memory kernel space (Leonhard 2018). The modification will be

9MELTDOWN AND SPECTRE
available to all Linux based system under the alias of page table isolation. Similar patches
have been discharged for other operating systems. It has some limitations but at least it can
prevent attacks by not allowing the attacker to have any memory locations or kernel pointers
in the user space that can leak sensitive information.
Spectre has two types: Variant 1 and Variant 2. To mitigate Variant 1, load fences
are imposed around the kernel. This prevents the speculation programme from loading a
second load when a first load is already performed (HPE 2018). The mitigation technique
requires putting small and minimum performance impacting changes in the source of the
kernel. To mitigate Variant 2 of Spectre, the hardware related to branch predicting needs to
be trained to understand which code should be favoured over what for execution. The
operating system can even deactivate the branch predicting hardware when the operating
system is asked by a program to attempt malicious activities. This approach is quite reliable
but the performance of the system suffers. The patches that have been implemented by
various vendors needs to be downloaded in the required systems even at the cost of
performance issues and for organizations, a system administrator needs to be present who can
toggle the patches on and off (Watson et al. 2018). Intel announced in January, 2018 that they
will ship new processors which are not vulnerable to Spectre as well as Meltdown. The
variant 1 of spectre will be mitigated with software changes while the variant 2 will be
mitigated with hardware changes. Intel announced that they have redesigned certain part of
the processors and introduced new security levels to prevent both variants of the Spectre
(Gibbs 2018). Micro codes which are software based has been launched for all Intel products
that has been launched in the last five years.
Permanent counter measure for Spectre is still not available yet.

10MELTDOWN AND SPECTRE
Future Impacts of Spectre and Meltdown
Cloud providers will be severely impacted due to Spectre rather than Meltdown
Although Meltdown uses unauthorised programs to obtain personal data from physical
memory processes on the cloud, Spectre utilizes a programs to send data to a guest system by
inducing a hypervisor.
In the future, the impacts of Spectre and Meltdown will result in more hardware
based attacks rather than software based attacks. Last year, in Intel’s remote administrative
feature named Management Engine a new vulnerability was discovered (Gens et al. 2017).
They affected the chips just like Spectre and Meltdown. As these vulnerabilities are
comparatively new, criminals, intelligence agencies and security researchers will be on the
hunt to research this new area.
Secondly, releasing patches for microprocessors require a coordinated effort of all
the major companies working in this area. Although patches have been released by AMD and
Intel, it will be a while before application vendors and computer manufacturers customize the
patch to make it functional for the user (Design News 2018). This makes it very difficult for
the vulnerabilities to remain a secret before appropriate patches are pushed out. As Spectre
and Meltdown were announced early, it gives hackers ample time to attack the system before
they are properly secured.
Thirdly, the patches for Spectre and Meltdown will affect the functionality of
computers. It was previously estimated that the patches will reduce the system performance
by as much as 30% but that was later proved to be true for only cloud based systems (Payer
2016). Still, as more vulnerabilities are discovered, further hardware patches will definitely
affect the core performance of the systems.

11MELTDOWN AND SPECTRE
Moreover, these vulnerabilities will not only infect the computers but also the
global infrastructure, medical devices, appliances, cars and smartphones. Information from
the infrastructure of cloud providers can be compromised to steal customer data. Personal
pictures, emails, critical documents and passwords can be stolen by exploiting these
vulnerabilities. These vulnerabilities will also impact future designs of microprocessors.
Blockchain technologies will be used widely in the future. Businesses will suffer as most of
them which handle sensitive information have to upgrade their entire system increasing the
total cost of the implementation (Engadget 2018). The appreciation and understanding for the
requirement of a secure system will change as researchers are pretty much sure that
speculative execution will be exploited further in the near future. More side channels attacks
can be expected as well.
Conclusions
To conclude the report, it can be stated that the research results have fundamentally
changed how software and hardware will be designed 10 to 20 years from now as the new
vulnerabilities of the leakage of data through the cache side channels have been discovered.
The implications of Spectre and Meltdown will have serious repercussions in the coming
years for all PC users. The mitigation strategies will even impact the performance of the
machines depending on the device’s hardware and workload specifications. Desktop users are
even more vulnerable to these attacks as the vulnerabilities use browser plugins to get access
to the user’s personal information with the help of JavaScript. Moreover, as the
vulnerabilities are very complex in nature, researchers may be able to find new exploits in the
future that are not covered in the current mitigation strategies. Researchers to have to be
quick to find the exploits properly and assign the same project to different teams so that the
vulnerabilities are confirmed independently. As speculative execution which is hardware