{"id":1616,"date":"2018-01-11T12:48:37","date_gmt":"2018-01-11T12:48:37","guid":{"rendered":"https:\/\/www.fastcomet.com\/blog\/?p=1616"},"modified":"2022-06-10T06:28:17","modified_gmt":"2022-06-10T06:28:17","slug":"addressing-meltdown-spectre","status":"publish","type":"post","link":"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre","title":{"rendered":"Addressing Meltdown and Spectre"},"content":{"rendered":"\n
Update: February 18, 2018
<\/strong>
Newly discovered variants of Meltdown\/Spectre dubbed MeltdownPrime and SpectrePrime that exploit invalidation-based coherence protocols with 99.95% accuracy of recovering hidden data have been discovered by Princeton and Nvidia researchers. However, we can confirm that the current software-based Meltdown\/Spectre mitigations rolled out on our servers are effective at confining them.<\/div>\n\n\n\n\n\n\n\n

In the days following the beginning of the New Year, our team became aware of a security flaw regarding the way modern CPUs (central processing unit<\/strong>) predict possible future user actions and store small bits of information in their cache in order to provide near-instant interaction for the user (Speculative Execution<\/strong>) as well the kernel\u2019s memory isolation which is set with the purpose of creating a closed environment for each user\/process on the machine.<\/p>\n\n\n\n

Both attacks act on a kernel-level and thus can skip the numerous security measures implemented on the machine including the operating system process and user separation. Both attacks are of side-channel type (attacks focused on exploiting side effects from computations in order to extract otherwise unavailable information) and were discovered by Jann Horn<\/a> (Google Project Zero<\/a>) as well as 3 other security teams independently from one another at the same time. These vulnerabilities are now called Meltdown and Spectre and categorized in 3 different variants:<\/p>\n\n\n\n

CVE-2017-5753<\/a> – bounds check bypass
CVE-2017-5715<\/a> – branch target injection
CVE-2017-5754<\/a> – rogue data cache load<\/p>\n\n\n\n

The Flaws<\/h2>\n\n\n\n

Meltdown<\/h3>\n\n\n\n

Meltdown got its name from the way it \u201cmelts\u201d the memory isolation which purpose is to keep user processes from reading the kernel memory. Meltdown can also read all physical memory mapped in the kernel region due to an inherited flaw of out-of-order execution<\/strong>. This is a type of execution of tasks which modern processors use as a performance boost to schedule subsequent operations to idle execution units of the processor instead of stalling the execution. This means that if a task needs 5 elements to be completed and in its programmed instructions the order is 1,2,3,4 and 5, if element 3 needs more time to be executed the CPU can complete 4 and 5 on the side and then only wait for 3, rearrange them again in their right order and finish the task. Meltdown takes advantage of this timing difference and looks for leaked information as out-of-order memory lookups in\ufb02uence the cache, which then can be detected, extracted and transmitted to a 3rd<\/sup> party.<\/p>\n\n\n\n

Spectre<\/h3>\n\n\n\n

This is a considerably harder vulnerability to exploit but also harder to mitigate as its effectiveness comes from the speculative executions a CPU does during normal workflow. If you have an \u201cif then – else\u201d structure which is still being decided on, the CPU will try to guess the outcome and attempt to execute ahead of time. When the value which determines the outcome \ufb01nally arrives, the CPU will either discard or commit the speculative computation it has already made. Spectre attacks can trick the CPU into speculatively executing instructions that should not have been executed in the first place. By detecting which executions were speculative, information can be mapped out within the memory of the system and then leaked via a microarchitectural covert channel.<\/p>\n\n\n\n

*Note that, while we did try to provide both an easy to understand explanations as well as some technical details regarding these security flaws, if you want to read a detailed explanation of both Meltdown and Spectre, you can visit the official Google Zero Project report<\/a> on the matter.<\/p>\n\n\n\n

Countermeasures<\/h2>\n\n\n\n

As some other cloud service providers, we took immediate measures in order to mitigate these vulnerabilities on a kernel-level using CloudLinux\u2019s just released CloudLinux 6 kernel version 2.6.32-896.16.1.lve1.4.49<\/strong> from their production repository.<\/p>\n\n\n\n

Some of you may have experienced a small window of unavailability due to a necessary unscheduled reboot of all Shared Hosting Servers in order for the patch to take effect.<\/p>\n\n\n\n

We are also rolling the updated Linux kernel version – 4.14.12 on our VPS and Dedicated Server nodes so no additional actions are required from our customers currently residing on these hosting plans. During the rollout, due to the sporadic release of patches and updates, we simply cannot notify all of our users of exact times when their Servers will be offline. However, with the general and broad nature of Spectre, we are expecting at least a few more mandatory reboots in order to mitigate all of its variations.<\/p>\n\n\n\n

We will update this post with more information when such is available.<\/p>\n","protected":false},"excerpt":{"rendered":"

Update: February 18, 2018Newly discovered variants of Meltdown\/Spectre dubbed MeltdownPrime and SpectrePrime that exploit invalidation-based coherence protocols with 99.95% accuracy of recovering hidden data have been discovered by Princeton and Nvidia researchers. However, we can confirm that the current software-based Meltdown\/Spectre mitigations rolled out on our servers are effective at confining them.<\/p>\n","protected":false},"author":3,"featured_media":1615,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[140],"tags":[224,9,225,75],"class_list":["post-1616","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-meltdown","tag-security","tag-spectre","tag-vulnerability"],"featured_image_src":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2018\/01\/meltdown-and-spectre.jpg","author_info":{"display_name":"Antoniy","author_link":"https:\/\/www.fastcomet.com\/blog\/author\/antoniy"},"yoast_head":"\nAddressing Meltdown and Spectre | FastComet<\/title>\n<meta name=\"description\" content=\"What is it about the Spectre and Meltdown attacks that scared everyone so much? \u27a4 Check our countermeasures against the massive security vulnerabilities.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Addressing Meltdown and Spectre | FastComet\" \/>\n<meta property=\"og:description\" content=\"What is it about the Spectre and Meltdown attacks that scared everyone so much? \u27a4 Check our countermeasures against the massive security vulnerabilities.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre\" \/>\n<meta property=\"og:site_name\" content=\"FastComet Blog\" \/>\n<meta property=\"article:published_time\" content=\"2018-01-11T12:48:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-06-10T06:28:17+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2018\/01\/meltdown-and-spectre.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"620\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Antoniy\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Antoniy\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Addressing Meltdown and Spectre | FastComet","description":"What is it about the Spectre and Meltdown attacks that scared everyone so much? \u27a4 Check our countermeasures against the massive security vulnerabilities.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre","og_locale":"en_US","og_type":"article","og_title":"Addressing Meltdown and Spectre | FastComet","og_description":"What is it about the Spectre and Meltdown attacks that scared everyone so much? \u27a4 Check our countermeasures against the massive security vulnerabilities.","og_url":"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre","og_site_name":"FastComet Blog","article_published_time":"2018-01-11T12:48:37+00:00","article_modified_time":"2022-06-10T06:28:17+00:00","og_image":[{"width":1024,"height":620,"url":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2018\/01\/meltdown-and-spectre.jpg","type":"image\/jpeg"}],"author":"Antoniy","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Antoniy","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre#article","isPartOf":{"@id":"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre"},"author":{"name":"Antoniy","@id":"https:\/\/www.fastcomet.com\/blog\/#\/schema\/person\/9c06dae35ff0e0a3a169eeae762a08d2"},"headline":"Addressing Meltdown and Spectre","datePublished":"2018-01-11T12:48:37+00:00","dateModified":"2022-06-10T06:28:17+00:00","mainEntityOfPage":{"@id":"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre"},"wordCount":737,"commentCount":2,"image":{"@id":"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre#primaryimage"},"thumbnailUrl":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2018\/01\/meltdown-and-spectre.jpg","keywords":["meltdown","security","spectre","vulnerability"],"articleSection":["Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre","url":"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre","name":"Addressing Meltdown and Spectre | FastComet","isPartOf":{"@id":"https:\/\/www.fastcomet.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre#primaryimage"},"image":{"@id":"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre#primaryimage"},"thumbnailUrl":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2018\/01\/meltdown-and-spectre.jpg","datePublished":"2018-01-11T12:48:37+00:00","dateModified":"2022-06-10T06:28:17+00:00","author":{"@id":"https:\/\/www.fastcomet.com\/blog\/#\/schema\/person\/9c06dae35ff0e0a3a169eeae762a08d2"},"description":"What is it about the Spectre and Meltdown attacks that scared everyone so much? \u27a4 Check our countermeasures against the massive security vulnerabilities.","breadcrumb":{"@id":"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre#primaryimage","url":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2018\/01\/meltdown-and-spectre.jpg","contentUrl":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2018\/01\/meltdown-and-spectre.jpg","width":1024,"height":620},{"@type":"BreadcrumbList","@id":"https:\/\/www.fastcomet.com\/blog\/addressing-meltdown-spectre#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.fastcomet.com\/blog"},{"@type":"ListItem","position":2,"name":"Addressing Meltdown and Spectre"}]},{"@type":"WebSite","@id":"https:\/\/www.fastcomet.com\/blog\/#website","url":"https:\/\/www.fastcomet.com\/blog\/","name":"FastComet Blog","description":"FastComet Web Hosting Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.fastcomet.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.fastcomet.com\/blog\/#\/schema\/person\/9c06dae35ff0e0a3a169eeae762a08d2","name":"Antoniy","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fastcomet.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/bebc2fa14b210e2e79c8a90be5e115a9b1cae5a04fe1151f238a76958c85a8ed?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/bebc2fa14b210e2e79c8a90be5e115a9b1cae5a04fe1151f238a76958c85a8ed?s=96&d=mm&r=g","caption":"Antoniy"},"description":"Antoniy\u2019s primary goal at FastComet is helping grow our client base through affiliates and strategic partnerships. It is all about statistics analysis, communication with our affiliates, working on various campaigns, searching the web for trends and generating ideas for future projects. You're likely to run across him at some point in the FastComet Community, too because he loves getting in and interacting with our great customers. You can always count on him to come up with strategic ideas for the team and is always searching for the smartest ways to spread our brand and services worldwide.","sameAs":["https:\/\/www.fastcomet.com"],"url":"https:\/\/www.fastcomet.com\/blog\/author\/antoniy"}]}},"_links":{"self":[{"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/posts\/1616","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/comments?post=1616"}],"version-history":[{"count":15,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/posts\/1616\/revisions"}],"predecessor-version":[{"id":7885,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/posts\/1616\/revisions\/7885"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/media\/1615"}],"wp:attachment":[{"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/media?parent=1616"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/categories?post=1616"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/tags?post=1616"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}