Meltdown: the processor flaw that opened protected memory

On January 3, 2018, researchers made public a flaw that was not in software, but in processors themselves. On most Intel processors, any program could read the memory of the kernel, the core of the operating system. On many systems, it could read all of the computer’s memory. The fix had to come from the operating systems. Windows, Linux, and macOS changed how they handle memory around the same time.

How it worked

Modern processors do not wait for every check before they work. To save time, they run instructions ahead and out of order, and throw the results away if a check fails later.

On Intel processors, a program’s attempt to read kernel memory ran for a moment before the permission check stopped it. The forbidden value was then thrown away, but the program had already used it to touch one particular entry of a large table. That entry stayed in the cache, a small, fast memory inside the processor. The program then timed how fast each entry of the table loaded, using a method called Flush+Reload. This way, it learned the secret value. By repeating these steps, it could read all kernel memory, byte by byte, without any software bug and without special rights.

Which processors are affected

The researchers’ site says that potentially every Intel processor with out-of-order execution since 1995 is affected, except Itanium and Atom before 2013. Their paper shows the attack on Intel generations since 2010. Of ARM’s own processor designs, only the Cortex-A75 is affected. Samsung’s Exynos M1 also leaked data in tests. AMD stated that its processors are not affected, the paper says.

Because the flaw is in the hardware, the operating system does not matter. On shared servers, programs in containers, which share one operating system, could read the memory of the host. So could some kinds of virtual machines.

The attack is fast. The researchers read kernel and physical memory at 3.2 to 503 kilobytes per second, depending on the machine. Data that was already in the processor’s fastest cache, called L1, came out even faster, with an error rate as low as 0.003 %.

Why a full memory read scores only 5.6

The NVD, the US National Vulnerability Database, rates Meltdown 5.6 out of 10 on version 3.0 of the CVSS scale: medium. That is not because the damage is small, but because of how the attack works. The attacker must already run a program on the computer, with ordinary user rights. The scale calls this a local attack. The attack is rated hard to carry out. And it can only read data, not change or delete it. Intel’s own advisory gives the same score. Shellshock, which works over the internet, scores 9.8.

The fix and the response

Google Project Zero reported the flaw to Intel, AMD, and ARM on June 1, 2017. Graz University of Technology and Cyberus Technology found it independently. For 216 days, the flaw was kept secret while operating-system makers prepared fixes.

The fix is called kernel page-table isolation (KPTI) and builds on a research design called KAISER. Page tables tell the processor which memory a program can see. KPTI removes the kernel’s memory from these tables while ordinary programs run. On January 3, 2018, Microsoft released the fix for Windows, for example in update KB4056892. Apple had already shipped fixes in iOS 11.2, macOS 10.13.2, and tvOS 11.2. Linux added KPTI. Newer processors fix the flaw in hardware.

The protection costs time on every switch between a program and the kernel. How much depends on the system and on which fixes a figure covers:

Spectre is the name of the two other flaws in Google Project Zero’s report. Most of the slowdown on Windows came from the fix for the second Spectre variant, Microsoft says. Red Hat’s worst case applies to workloads with many switches into the kernel, such as databases that handle many small transactions. It does not show the cost of the Meltdown fix alone.