{"data":{"case":{"actions":{"de":["Installiere die Updates deines Betriebssystems: Windows, Linux, macOS und iOS erhielten den Fix rund um Januar 2018.","Führe auf einem alten Computer, dessen System keine Updates mehr bekommt, keine Programme aus, denen du nicht vertraust: Jedes Programm kann den Speicher des Systems lesen.","Wenn du Server mietest oder Container betreibst, frag deinen Anbieter, ob der Host den Fix hat: Container und manche virtuellen Maschinen konnten den Speicher des Hosts lesen."],"en":["Install your operating system's updates: Windows, Linux, macOS and iOS received the fix around January 2018.","On an old computer whose system no longer gets updates, do not run programs you do not trust: any program can read the memory of the system.","If you rent servers or run containers, ask your provider whether the host has the fix: containers and some virtual machines could read the host's memory."]},"criteria":{"damage":{"de":"Es ist kein Schaden dokumentiert.","en":"No damage has been documented.","met":false},"exploitation":{"de":"Es sind keine Angriffe in der Praxis bekannt, und die Lücke steht nicht auf der Liste ausgenutzter Schwachstellen der CISA (Apple; NVD, Oktober 2026).","en":"No attacks in the wild are known, and the flaw is not on CISA's list of exploited vulnerabilities (Apple; NVD, October 2026).","met":false},"reach":{"de":"Potenziell ist jeder Intel-Prozessor mit Out-of-Order-Ausführung seit 1995 betroffen, außer Itanium und Atom vor 2013; der Fachartikel zeigt den Angriff auf Intel-Generationen seit 2010 (Website der Forscher; USENIX-Fachartikel).","en":"Potentially every Intel processor with out-of-order execution since 1995 is affected, except Itanium and Atom before 2013; the paper shows the attack on Intel generations since 2010 (researchers' site; USENIX paper).","met":true},"response":{"de":"Windows, Linux und macOS trennten den Kernel-Speicher mit Updates rund um die Veröffentlichung ab, vorbereitet in 216 Tagen Geheimhaltung (Microsoft; Apple; Google Project Zero).","en":"Windows, Linux and macOS isolated kernel memory with updates around the disclosure, prepared during 216 days of secrecy (Microsoft; Apple; Google Project Zero).","met":true}},"cves":["CVE-2017-5754"],"cvss":5.6,"cvss_version":"3.0","cwe":"CWE-200","dates":[{"date":"2017-06-01","key":"reported"},{"date":"2018-01-03","key":"disclosed"},{"date":"2018-01-03","de":"Windows-Update mit dem Fix; Apple hatte seinen bereits ausgeliefert","en":"Windows update with the fix; Apple had already shipped its own"},{"date":"2018-08-15","de":"Die Forscher stellen den vollständigen Fachartikel auf der USENIX Security 2018 vor","en":"The researchers present the full paper at USENIX Security 2018"}],"de":{"credit":"Google Project Zero, die Technische Universität Graz und Cyberus Technology, unabhängig voneinander","fixed":"Betriebssystem-Updates rund um die Veröffentlichung: KPTI in Linux, Windows KB4056892 (3. Januar 2018), macOS 10.13.2 und iOS 11.2; neuere Prozessoren beheben die Lücke in der Hardware","product":"Die meisten Intel-Prozessoren und einige ARM-basierte Designs","summary":"Ein Designfehler der meisten Intel-Prozessoren ließ jedes Programm den geschützten Speicher des Betriebssystems lesen; Updates der Betriebssysteme schlossen die Lücke."},"disclosed":"2018-01-03","en":{"credit":"Google Project Zero, Graz University of Technology and Cyberus Technology, independently of each other","fixed":"Operating-system updates around the disclosure: KPTI in Linux, Windows KB4056892 (January 3, 2018), macOS 10.13.2 and iOS 11.2; newer processors fix it in hardware","product":"Most Intel processors, and a few ARM-based designs","summary":"A design flaw in most Intel processors let any program read the operating system's protected memory; operating-system updates closed the hole."},"figures":[{"de":"Kilobyte pro Sekunde: so schnell las ein gewöhnliches Programm Kernel-Speicher, je nach Rechner","en":"kilobytes per second: how fast an ordinary program read kernel memory, depending on the machine","value":"3.2–503"},{"de":"Tage blieb die Lücke geheim, während Fixes vorbereitet wurden","en":"days the flaw was kept secret while fixes were prepared","value":"216"},{"de":"ist das Jahr, seit dem potenziell jeder Intel-Prozessor mit Out-of-Order-Ausführung betroffen ist, sagen die Forscher","en":"is the year since which potentially every Intel processor with out-of-order execution is affected, say the researchers","value":"1995"}],"key":"meltdown","name":"Meltdown","product":"Intel processors","sources":[{"de":"Google Project Zero: privilegierten Speicher über einen Seitenkanal lesen","title":"Google Project Zero: Reading privileged memory with a side-channel","url":"https://projectzero.google/2018/01/reading-privileged-memory-with-side.html"},{"de":"Website der Forscher zu Meltdown und Spectre","title":"The researchers' site on Meltdown and Spectre","url":"https://meltdownattack.com/"},{"de":"Meltdown: Kernel-Speicher aus dem Benutzerbereich lesen (USENIX Security 2018)","title":"Meltdown: Reading Kernel Memory from User Space (USENIX Security 2018)","url":"https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-lipp.pdf"},{"de":"NVD: CVE-2017-5754","title":"NVD: CVE-2017-5754","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5754"},{"de":"Intel-Sicherheitshinweis INTEL-SA-00088","title":"Intel security advisory INTEL-SA-00088","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00088.html"},{"de":"Microsoft: Windows-Update KB4056892 vom 3. Januar 2018","title":"Microsoft: Windows update KB4056892 of January 3, 2018","url":"https://support.microsoft.com/en-us/help/4056892"},{"de":"Microsoft: Leistungseinbußen durch die Fixes für Spectre und Meltdown unter Windows","title":"Microsoft: performance impact of the Spectre and Meltdown fixes on Windows","url":"https://www.microsoft.com/en-us/security/blog/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/"},{"de":"Apple: zu den Fixes für Meltdown und Spectre","title":"Apple: about the Meltdown and Spectre fixes","url":"https://support.apple.com/en-us/HT208394"},{"de":"Red Hat: Leistungseinbußen durch die Fixes für alle drei Varianten","title":"Red Hat: performance impact of the fixes for all three variants","url":"https://access.redhat.com/articles/3307751"}],"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","year":2018}},"description":"A design flaw in most Intel processors let any program read the operating system's protected memory. Why it scores only 5.6, and how the fix works.","language":"en","latest_measurement":"2026-10-23","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"On January 3, 2018, researchers made public a flaw that was not in software, but in processors themselves. On most Intel processors, any program could read the memory of the kernel, the core of the operating system, and on many systems all of the computer\u0026rsquo;s memory. The fix had to come from the operating systems, and Windows, Linux, and macOS changed how they handle memory around the same time.\nHow it worked Modern processors do not wait for every check before they work. To save time, they run instructions ahead and out of order, and throw the results away if a check fails later.\nOn Intel processors, a program\u0026rsquo;s attempt to read kernel memory ran for a moment before the permission check stopped it. The forbidden value was then thrown away, but the program had already used it to touch one particular entry of a large table. That entry stayed in the cache, a small, fast memory inside the processor. By timing how fast each entry of the table loads afterwards, a method called Flush+Reload, the program learns the secret value. By repeating this, it can read all kernel memory, byte by byte, without any software bug and without special rights.\nProgramasks for a byte of kernel memory Processorruns ahead before the permission check Cachekeeps a trace of the secret byte Timingreveals the byte, then the next The processor throws the forbidden result away, but its trace in the cache remains and can be measured. Which processors are affected How far Meltdown reaches depends on the question. The researchers\u0026rsquo; site says that potentially every Intel processor with out-of-order execution since 1995 is affected, except Itanium and Atom before 2013. Their paper shows the attack on Intel generations since 2010. Of ARM\u0026rsquo;s own processor designs, only the Cortex-A75 is affected; Samsung\u0026rsquo;s Exynos M1 also leaked data in tests. AMD stated that its processors are not affected, the paper says.\nBecause the flaw is in the hardware, it does not matter which operating system runs on it. On shared servers, programs in containers, which share one operating system, and some kinds of virtual machines could read the memory of the host.\nThe attack is fast. The researchers read kernel and physical memory at 3.2 to 503 kilobytes per second, depending on the machine. Data that was already in the processor\u0026rsquo;s fastest cache, called L1, came out even faster, with an error rate as low as 0.003 %.\nHow fast Meltdown reads memory, in kilobytes per second Core i7-8700K, data in the L1 cache582 KB/s Core i7-6700K, data in the L1 cache569 KB/s Xeon E5-1630, data in the L1 cache491 KB/s Core i7-6700K, data only in the L3 cache12.4 KB/s Data in no cache, with optimizations3.2 KB/s Source: Meltdown paper, USENIX Security 2018. L1 and L3 are levels of the processor\u0026rsquo;s cache. Without the optimizations, data in no cache came out at less than 10 bytes per second on most systems.\nWhy a full memory read scores only 5.6 The NVD, the US National Vulnerability Database, rates Meltdown 5.6 out of 10 on version 3.0 of the CVSS scale: medium. That is not because the damage is small. It is because of how the attack works. The attacker must already run a program on the computer, with ordinary user rights, which the scale calls a local attack. The attack is rated hard to carry out. And it only reads data; it cannot change or delete anything. Intel\u0026rsquo;s own advisory gives the same score. Shellshock, which works over the internet, scores 9.8.\nThe fix and the response Google Project Zero reported the flaw to Intel, AMD, and ARM on June 1, 2017. Graz University of Technology and Cyberus Technology found it independently. For 216 days, the flaw was kept secret while operating-system makers prepared fixes. Such a period of agreed secrecy is called an embargo.\nThe fix is called kernel page-table isolation (KPTI) and builds on a research design called KAISER. Page tables are the map that tells the processor which memory a program can see. With KPTI, the kernel\u0026rsquo;s memory is removed from that map while ordinary programs run. Microsoft released a Windows update with the fix on January 3, 2018, for example KB4056892. Apple had already shipped fixes in iOS 11.2, macOS 10.13.2, and tvOS 11.2. Linux added KPTI. Newer processors fix the flaw in hardware.\nThe protection costs time on every switch between a program and the kernel. How much depends on the system and on which fixes a figure covers:\nSourceWhat it foundFixes covered MicrosoftMinimal impactMeltdown and the first Spectre variant AppleNo measurable reduction in macOS and iOS benchmarksMeltdown Red Hat8–19 % slower for the most affected workloads, 4–8 % after a later optimization called retpolineMeltdown and both Spectre variants together Spectre is the name of the two other flaws in Google Project Zero\u0026rsquo;s report. Most of the slowdown on Windows came from the fix for the second Spectre variant, Microsoft says. Red Hat\u0026rsquo;s worst case applies to workloads with many switches into the kernel, such as databases that handle many small transactions. It does not show the cost of the Meltdown fix alone.","title":"Meltdown: the processor flaw that opened protected memory","url":"https://crackthe.net/vulnerabilities/meltdown/"}