{"data":{"case":{"actions":{"de":["Installiere alle Updates für dein Betriebssystem und deinen Browser: Sie enthalten den Schutz gegen Spectre.","Installiere Prozessor-Updates (Mikrocode), sobald dein Betriebssystem oder der Hersteller deines Geräts sie anbietet.","Lass die Schutzmaßnahmen eingeschaltet; Linux aktiviert sie auf anfälligen Prozessoren standardmäßig."],"en":["Install all updates for your operating system and browser: they include the protections against Spectre.","Install processor updates (microcode) when your operating system or device maker offers them.","Leave the protections switched on; Linux turns them on by default on vulnerable processors."]},"criteria":{"damage":{"de":"Schäden durch Angriffe sind nicht dokumentiert; die Kosten lagen in den Fixes, die manche Systeme langsamer machten.","en":"No damage from attacks has been documented; the cost lay in the fixes, which made some systems slower.","met":false},"exploitation":{"de":"Kein echter Angriff ist bestätigt, und keine der beiden Spectre-CVEs steht auf der CISA-Liste ausgenutzter Schwachstellen (NVD, Oktober 2026).","en":"No attack in the wild has been confirmed, and neither Spectre CVE is on CISA's list of exploited vulnerabilities (NVD, October 2026).","met":false},"reach":{"de":"Die Lücke steckt in Prozessoren von Intel, AMD und Arm, die in Milliarden von Geräten arbeiten, vom Smartphone bis zum Cloud-Server (Spectre-Studie und Website der Forscher, 2018).","en":"The flaw sits in processors from Intel, AMD and Arm that are used in billions of devices, from smartphones to cloud servers (Spectre paper and researchers' site, 2018).","met":true},"response":{"de":"Fixes von Prozessorherstellern, für Betriebssysteme, Compiler und Browser zugleich, mit Windows-Patches für 41 von 45 Editionen binnen sechs Tagen (Microsoft, 9. Januar 2018).","en":"Fixes from processor makers, operating systems, compilers and browsers at once, with Windows patches for 41 of 45 editions within six days (Microsoft, January 9, 2018).","met":true}},"cves":["CVE-2017-5753","CVE-2017-5715"],"cvss":5.6,"cvss_version":"3.1","cwe":"CWE-203","dates":[{"date":"2017-06-01","key":"reported"},{"date":"2018-01-03","de":"Sechs Tage früher als geplant veröffentlicht, zusammen mit den ersten Updates","en":"Made public six days early, together with the first updates"},{"date":"2018-01-09","de":"Der ursprünglich geplante Termin; Windows-Patches für 41 von 45 Editionen verfügbar","en":"The originally planned date; Windows patches out for 41 of 45 editions"}],"de":{"credit":"Google Project Zero und, unabhängig davon, Forscher von Universitäten und Unternehmen","fixed":"Kein einzelner Fix: Updates für Betriebssysteme, Browser, Compiler und Prozessor-Mikrocode, ab dem 3. Januar 2018","product":"Prozessoren von Intel, AMD und Arm, in Milliarden von Geräten","summary":"Ein Designfehler in fast allen modernen Prozessoren ließ Programme Speicher lesen, den sie nicht sehen dürften, auf Desktop-PCs, Laptops, Servern und Smartphones."},"disclosed":"2018-01-03","en":{"credit":"Google Project Zero and, independently, researchers from universities and companies","fixed":"No single fix: updates for operating systems, browsers, compilers and processor microcode, from January 3, 2018","product":"Processors from Intel, AMD and Arm, in billions of devices","summary":"A design flaw in almost all modern processors let programs read memory they should not see, on desktops, laptops, servers and smartphones."},"figures":[{"de":"Windows-Editionen brauchten Patches; für 41 gab es sie sechs Tage nach der Veröffentlichung","en":"Windows editions needed patches; 41 had them six days after disclosure","value":"45"},{"de":"Leistungsverlust mit allen Meltdown- und Spectre-Fixes in den von Red Hat getesteten Anwendungen, mit Retpoline","en":"slowdown with all Meltdown and Spectre fixes on Red Hat's tested workloads, with retpoline","value":"1–8 %"},{"de":"Tage vergingen von der Meldung an Intel, AMD und Arm bis zur Veröffentlichung","en":"days from the report to Intel, AMD and Arm until the flaw went public","value":"216"}],"key":"spectre","name":"Spectre","product":"Intel, AMD and Arm processors","sources":[{"de":"Google Project Zero: Auslesen von geschütztem Speicher über einen Seitenkanal","title":"Google Project Zero: reading privileged memory with a side channel","url":"https://projectzero.google/2018/01/reading-privileged-memory-with-side.html"},{"de":"Google Security Blog: die Prozessor-Schwachstelle und was du wissen musst","title":"Google Security Blog: today's CPU vulnerability and what you need to know","url":"https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html"},{"de":"Google Cloud: Schutz vor den neuen Schwachstellen ohne Leistungseinbußen","title":"Google Cloud: protecting customers from the new vulnerabilities without hurting performance","url":"https://cloud.google.com/blog/topics/inside-google-cloud/protecting-our-google-cloud-customers-new-vulnerabilities-without-impacting-performance"},{"de":"Website der Forscher zu Meltdown und Spectre, mit FAQ","title":"The researchers' site on Meltdown and Spectre, with FAQ","url":"https://spectreattack.com/"},{"de":"Die Spectre-Studie (arXiv, Januar 2018)","title":"The Spectre paper (arXiv, January 2018)","url":"https://arxiv.org/abs/1801.01203"},{"de":"NVD: CVE-2017-5753","title":"NVD: CVE-2017-5753","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5753"},{"de":"Microsoft: Leistungseinbußen durch die Spectre- und Meltdown-Fixes unter Windows","title":"Microsoft: performance impact of the Spectre and Meltdown fixes on Windows","url":"https://www.microsoft.com/en-us/security/blog/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/"},{"de":"Red Hat: Leistungseinbußen durch die Meltdown- und Spectre-Fixes","title":"Red Hat: performance impact of the Meltdown and Spectre fixes","url":"https://access.redhat.com/articles/3307751"},{"de":"Dokumentation des Linux-Kernels zu Spectre","title":"Linux kernel documentation on Spectre","url":"https://docs.kernel.org/admin-guide/hw-vuln/spectre.html"},{"de":"Ein Sicherheitsforscher über einen funktionierenden Spectre-Exploit auf VirusTotal (2021)","title":"A security researcher on a working Spectre exploit found on VirusTotal (2021)","url":"https://dustri.org/b/spectre-exploits-in-the-wild.html"}],"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","year":2018}},"description":"A design flaw in processors from Intel, AMD and Arm let programs read memory they should never see. How it works, what the fixes cost, and what to do now.","language":"en","latest_measurement":"2026-10-23","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"On January 3, 2018, Google Project Zero and, independently, researchers from several universities and companies made public a flaw in the design of modern processors. Called Spectre, it lets a program trick the processor into revealing memory it should never be able to read, such as data of the operating system or of other programs. The affected processors from Intel, AMD and Arm are used in billions of devices, and according to Google, the flaw had been in most computers for nearly 20 years.\nSpectre is not a bug in one product that a single update removes. It lies in the way processors work, so the fixes had to come from many sides at once.\nHow it worked To stay fast, a modern processor does not wait until it knows which way a program will go next. It guesses and works ahead. This is called speculative execution. If the guess was wrong, the processor throws the results away. But it leaves traces in its cache, a small and fast memory that keeps recently used data close at hand.\nSpectre comes in two variants. The first abuses a check that careful programs make: before they read entry number x of a list, they check that x lies inside the list. The attacker first trains the processor to expect that the check passes. Then the attacker asks for an entry far outside the list. While the check is still running, the processor guesses, reads a secret byte beyond the end of the list and uses it to load a piece of memory into the cache. The result is thrown away. But the attacker measures how fast different pieces of memory respond, sees which one was loaded and works out the secret byte from that.\nIn the second variant, the attacker trains the processor\u0026rsquo;s guesses for jumps in another program, such as the operating system or a hypervisor, the software that runs virtual machines in a cloud. The victim then briefly runs code fragments chosen by the attacker, which leak data in the same way.\nAttacker\u0026#39;s programtrains the processor\u0026#39;s guesses Processorguesses wrong and reads a secret byte ahead of time Cachekeeps a trace of the byte Timingfast and slow memory give the byte away Spectre in four steps: the processor discards the wrong result, but the trace it leaves in the cache reveals the secret. The attacker\u0026rsquo;s program must already run on the same device, the attack is hard to carry out, and it can read data but not change it. That is why the US National Vulnerability Database scores Spectre at only 5.6 of 10. Still, the attack worked in Google\u0026rsquo;s tests. With normal user rights, it read the memory of the kernel, the core of the operating system, at around 2,000 bytes per second. From inside a virtual machine, it read the kernel memory of the host machine at around 1,500 bytes per second.\nReach and the cost of the fixes According to the researchers, almost every system is affected: desktops, laptops, cloud servers and smartphones. Google Project Zero\u0026rsquo;s test attacks ran on processors from all three makers: an Intel Xeon, two AMD processors and the Arm processor of a Nexus 5X phone.\nHas Spectre been used in real attacks? The researchers\u0026rsquo; answer is: \u0026ldquo;We don\u0026rsquo;t know.\u0026rdquo; No attack has been confirmed, and neither of the two Spectre CVEs is on the list of exploited vulnerabilities kept by the US agency CISA. In February 2021, a working exploit for Linux and Windows, a program that carries out the attack, was uploaded to VirusTotal, a service that checks files for malware, a security researcher reported. That is a ready-made tool, not an observed attack.\nThe price of Spectre was paid in speed. Some fixes stop processors from guessing certain jumps or make them clear their guesses more often, and that costs time. Most published measurements cover the fixes for Spectre and for Meltdown, a related processor flaw made public alongside it, together.\nSlowdown with all Meltdown and Spectre fixes, by workload Transaction databases, first fixes19 % Transaction databases, with retpoline8 % Data analysis and Java, first fixes7 % Data analysis and Java, with retpoline5 % Number crunching, first fixes5 % Number crunching, with retpoline2 % Red Hat, upper end of each measured range, for the Meltdown fix and both Spectre variants together. Retpoline, explained below, lowered the cost. As of March 2019.\nMicrosoft measured single-digit slowdowns on Windows 10 PCs with processors from around 2016 or newer. Older PCs and Windows Server slowed down more, especially when they read and wrote a lot of data. Google reported that it rolled out its fixes across its cloud without customers noticing: it received no support tickets about them.\nThe fix: many small repairs Google Project Zero reported the flaw to Intel, AMD and Arm on June 1, 2017. A joint publication was planned for January 9, 2018, but Google went public six days early because reports had already appeared. According to Google, all of its cloud services had protections against all known variants by December 2017.\nThe fixes came from several sides, starting on January 3, 2018: updates for operating systems and browsers, new techniques in compilers, the tools that turn source code into programs, and microcode updates, which change the built-in control program of the processor. Microsoft released its first updates on January 3. Six days later, patches for 41 of the 45 Windows editions it supported were available through Windows Update.\nVariantWhat the attacker abusesMain defenses 1, bounds check bypassthe guess that a check on a list will passbarriers or masking in the program code, and programs rebuilt with them 2, branch target injectionthe guesses for jumps in other programsretpoline in software, or new processor controls delivered by microcode Retpoline rewrites jumps in a program so that the processor\u0026rsquo;s guesses end up in a harmless loop. Google says it fully protects against the second variant without affecting its customers\u0026rsquo; performance, and the Linux kernel turns it on by default on vulnerable processors. Newer processors have a hardware feature called enhanced IBRS, which limits the guessing of jumps; the kernel documentation describes it as more efficient than retpoline.","title":"Spectre: when the speed tricks of processors leak secrets","url":"https://crackthe.net/vulnerabilities/spectre/"}