The First Major Security Logos of 2018: Spectre and Meltdown Vulnerabilities

A major flaw in the way modern CPUs access cache memory could allow one program to access data from another program. The latest security vulnerability affects a majority of systems, if not all, used today. The vulnerabilities are named Spectre and Meltdown and also have a dedicated website.

According to the security advisory, Spectre breaks the isolation between different applications and allows an attacker to expose data once thought to be secure. Meltdown breaks the most fundamental isolation between user applications and the operating system. Both attacks are independent of the operating system and do not rely on any software vulnerabilities. To reduce the risk of compromise, users must apply software patches as quickly as possible.

Side channel attacks

The new bugs are considered side channel attacks since they use side channels to obtain the information from the accessed memory location. Spectre allows an application to force another application to access arbitrary portions of its memory, which can then be read through a side channel. This unique side channel attack is done by speculative execution, a technique used by high-speed processors in order to increase performance by guessing likely future execution paths and preemptively executing the instructions in them. Spectre takes advantage of this execution and affects all modern processors capable of keeping instructions in flight.

Furthermore, memory isolation is a cornerstone of security and the environment that allows multiple processes to be run on a device. The Meltdown bug allows any application to access all system memory including memory allocated to the kernel and overcomes the memory isolation. The unique side channel attack is one side effect caused by out-of-order execution that is used as a performance enhancement for processors. Meltdown specifically affects every Intel processor on all desktop, laptop and cloud computers except Intel Itanium and Intel Atom before 2013.

Identifying affected systems

Operating system vendors are forgoing regular patch release cycles and publishing operating system patches to address this issue. Tenable.io, SecurityCenter and Nessus can identify affected systems by looking for the newly released patches. Each plugin created for the Spectre and Meltdown vulnerabilities will be marked with at least one of the following CVEs :

• CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
• CVE-2017-5754: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.

To identify which systems are affected using Tenable.io, open the workbench and, using the advanced search, apply a CVE filter (CVE-2017-5753,CVE-2017-5715,CVE-2017-5754) as shown below. In the example filter, each CVE is placed in the field separated using a comma.

Plugins

When searching for the plugins using CVE you will find several plugins. This list will be updated as more plugins are released.

Wrapping up

We will continue to research these vulnerabilities, and investigate different ways to detect them. When new information is available, we will release additional plugins. This vulnerability is a real and present danger to all organizations and should be patched immediately. While Microsoft, Red Hat, VMWare and other vendors are making efforts to release patches, organizations are responsible for applying those patches as soon as possible.