Meltdown: the processor flaw that opened protected memory

On January 3, 2018, researchers made public a flaw that was not in software, but in processors themselves. On most Intel processors, any program could read the memory of the kernel, the core of the operating system, and on many systems all of the computer’s memory. The fix had to come from the operating systems, and Windows, Linux, and macOS changed how they handle memory around the same time.

How it worked

Modern processors do not wait for every check before they work. To save time, they run instructions ahead and out of order, and throw the results away if a check fails later.

On Intel processors, a program’s attempt to read kernel memory ran for a moment before the permission check stopped it. The forbidden value was then thrown away, but the program had already used it to touch one particular entry of a large table. That entry stayed in the cache, a small, fast memory inside the processor. By timing how fast each entry of the table loads afterwards, a method called Flush+Reload, the program learns the secret value. By repeating this, it can read all kernel memory, byte by byte, without any software bug and without special rights.

Which processors are affected

How far Meltdown reaches depends on the question. The researchers’ site says that potentially every Intel processor with out-of-order execution since 1995 is affected, except Itanium and Atom before 2013. Their paper shows the attack on Intel generations since 2010. Of ARM’s own processor designs, only the Cortex-A75 is affected; Samsung’s Exynos M1 also leaked data in tests. AMD stated that its processors are not affected, the paper says.

Because the flaw is in the hardware, it does not matter which operating system runs on it. On shared servers, programs in containers, which share one operating system, and some kinds of virtual machines could read the memory of the host.

The attack is fast. The researchers read kernel and physical memory at 3.2 to 503 kilobytes per second, depending on the machine. Data that was already in the processor’s fastest cache, called L1, came out even faster, with an error rate as low as 0.003 %.

Why a full memory read scores only 5.6

The NVD, the US National Vulnerability Database, rates Meltdown 5.6 out of 10 on version 3.0 of the CVSS scale: medium. That is not because the damage is small. It is because of how the attack works. The attacker must already run a program on the computer, with ordinary user rights, which the scale calls a local attack. The attack is rated hard to carry out. And it only reads data; it cannot change or delete anything. Intel’s own advisory gives the same score. Shellshock, which works over the internet, scores 9.8.

The fix and the response

Google Project Zero reported the flaw to Intel, AMD, and ARM on June 1, 2017. Graz University of Technology and Cyberus Technology found it independently. For 216 days, the flaw was kept secret while operating-system makers prepared fixes. Such a period of agreed secrecy is called an embargo.

The fix is called kernel page-table isolation (KPTI) and builds on a research design called KAISER. Page tables are the map that tells the processor which memory a program can see. With KPTI, the kernel’s memory is removed from that map while ordinary programs run. Microsoft released a Windows update with the fix on January 3, 2018, for example KB4056892. Apple had already shipped fixes in iOS 11.2, macOS 10.13.2, and tvOS 11.2. Linux added KPTI. Newer processors fix the flaw in hardware.

The protection costs time on every switch between a program and the kernel. How much depends on the system and on which fixes a figure covers:

Spectre is the name of the two other flaws in Google Project Zero’s report. Most of the slowdown on Windows came from the fix for the second Spectre variant, Microsoft says. Red Hat’s worst case applies to workloads with many switches into the kernel, such as databases that handle many small transactions. It does not show the cost of the Meltdown fix alone.