Original release date: January 04, 2018
Systems Affected
CPU hardware implementations
Overview
On January 3, 2018, the National Cybersecurity and Communications Integration Center (NCCIC) became aware of a set of security vulnerabilities—known as Meltdown and Spectre— that affect modern computer processors. Exploitation of these vulnerabilities could allow an attacker to obtain access to sensitive information.
Description
CPU hardware implementations are vulnerable to side-channel attacks referred to as Meltdown and Spectre. These attacks are described in detail by CERT/CC’s Vulnerability Note VU#584653, the United Kingdom National Cyber Security Centre’s guidance on Meltdown and Spectre, Google Project Zero, and the Institute of Applied Information Processing and Communications (IAIK) at Graz University of Technology (TU Graz). The Linux kernel mitigations for this vulnerability are referred to as KAISER, and subsequently KPTI, which aim to improve separation of kernel and user memory pages.
Impact
Exploitation of these vulnerabilities could allow an attacker to obtain access to sensitive information.
Solution
NCCIC encourages users and administrators to refer to their OS vendors for the most recent information. However, the table provided below lists available advisories and patches. Due to the fact that the vulnerability exists in CPU architecture rather than in software, patching may not fully address these vulnerabilities in all cases.
After patching, performance may be diminished by up to 30 percent. Administrators should ensure that performance is monitored for critical applications and services, and work with their vendor(s) and service provider(s) to mitigate the effect if possible.
Additionally, impacts to availability in some cloud service providers (CSPs) have been reported as a result of patches to host OSes. Users and administrators who rely on cloud infrastructure should work with their CSP to mitigate and resolve any impacts resulting from host OS patching and mandatory rebooting.
The following table contains links to advisories and patches published in response to the vulnerabilities.
Link to Vendor InformationDate Added
References
This product is provided subject to this Notification and this Privacy & Use policy.
Continue reading...
Systems Affected
CPU hardware implementations
Overview
On January 3, 2018, the National Cybersecurity and Communications Integration Center (NCCIC) became aware of a set of security vulnerabilities—known as Meltdown and Spectre— that affect modern computer processors. Exploitation of these vulnerabilities could allow an attacker to obtain access to sensitive information.
Description
CPU hardware implementations are vulnerable to side-channel attacks referred to as Meltdown and Spectre. These attacks are described in detail by CERT/CC’s Vulnerability Note VU#584653, the United Kingdom National Cyber Security Centre’s guidance on Meltdown and Spectre, Google Project Zero, and the Institute of Applied Information Processing and Communications (IAIK) at Graz University of Technology (TU Graz). The Linux kernel mitigations for this vulnerability are referred to as KAISER, and subsequently KPTI, which aim to improve separation of kernel and user memory pages.
Impact
Exploitation of these vulnerabilities could allow an attacker to obtain access to sensitive information.
Solution
NCCIC encourages users and administrators to refer to their OS vendors for the most recent information. However, the table provided below lists available advisories and patches. Due to the fact that the vulnerability exists in CPU architecture rather than in software, patching may not fully address these vulnerabilities in all cases.
After patching, performance may be diminished by up to 30 percent. Administrators should ensure that performance is monitored for critical applications and services, and work with their vendor(s) and service provider(s) to mitigate the effect if possible.
Additionally, impacts to availability in some cloud service providers (CSPs) have been reported as a result of patches to host OSes. Users and administrators who rely on cloud infrastructure should work with their CSP to mitigate and resolve any impacts resulting from host OS patching and mandatory rebooting.
The following table contains links to advisories and patches published in response to the vulnerabilities.
Link to Vendor InformationDate Added
AmazonJanuary 4, 2018
AMDJanuary 4, 2018
AndroidJanuary 4, 2018
AppleJanuary 4, 2018
ARMJanuary 4, 2018
CentOSJanuary 4, 2018
ChromiumJanuary 4, 2018
CitrixJanuary 4, 2018
F5January 4, 2018
GoogleJanuary 4, 2018
HuaweiJanuary 4, 2018
IBMJanuary 4, 2018
IntelJanuary 4, 2018
LenovoJanuary 4, 2018
LinuxJanuary 4, 2018
Microsoft AzureJanuary 4, 2018
MicrosoftJanuary 4, 2018
MozillaJanuary 4, 2018
NVIDIAJanuary 4, 2018
OpenSuSEJanuary 4, 2018
Red HatJanuary 4, 2018
SuSEJanuary 4, 2018
Trend MicroJanuary 4, 2018
VMwareJanuary 4, 2018
XenJanuary 4, 2018
AMDJanuary 4, 2018
AndroidJanuary 4, 2018
AppleJanuary 4, 2018
ARMJanuary 4, 2018
CentOSJanuary 4, 2018
ChromiumJanuary 4, 2018
CitrixJanuary 4, 2018
F5January 4, 2018
GoogleJanuary 4, 2018
HuaweiJanuary 4, 2018
IBMJanuary 4, 2018
IntelJanuary 4, 2018
LenovoJanuary 4, 2018
LinuxJanuary 4, 2018
Microsoft AzureJanuary 4, 2018
MicrosoftJanuary 4, 2018
MozillaJanuary 4, 2018
NVIDIAJanuary 4, 2018
OpenSuSEJanuary 4, 2018
Red HatJanuary 4, 2018
SuSEJanuary 4, 2018
Trend MicroJanuary 4, 2018
VMwareJanuary 4, 2018
XenJanuary 4, 2018
References
- Graz University of Technology Meltdown website
- Graz University of Technology Spectre website
- CERT/CC’s Vulnerability Note VU#584653
- United Kingdom National Cyber Security Centre’s guidance on Meltdown and Spectre
- Google Project Zero blog
- January 4, 2018: Initial version
This product is provided subject to this Notification and this Privacy & Use policy.
Continue reading...
