“Meltdown” and “Spectre” – Vulnerabilities in processors!

“Meltdown” and “Spectre” are the names given by security experts to two vulnerabilities in processors or central processing units (CPUs). They were discovered by a team comprised of Google Project Zero employees, university researchers and industry experts. Many modern processors including Intel, AMD and ARM are affected. Security specialists and manufacturers alike describe them as a very serious problem, and all stakeholders are doing their utmost to provide updates fast.

Design flaws in processors

The security architecture of computer chips – the hardware design – is not safe. In other words, normal programs running in the application memory can gain access to the layout and contents of the protected kernel. To prevent this from happening, the kernel memory and the application memory would have to be strictly isolated from one another (hardened).

What can happen?

“Meltdown” and “Spectre” allow cybercriminals to read sensitive data like passwords or “crypto-keys”. They are then in a position to manipulate, or in the worst case delete, other data. They take advantage of a feature of modern out-of-order processors, which do exactly what their name says: work out of order. To fulfill this mission, they must speculatively execute a few instructions which may not actually be executed in the real program flow if the speculation is wrong. These instructions often load data that is assumed to be required into the caches, update the translation lookaside buffers (TLB) needed to calculate the address and make more speculative preparations – all of which delivers huge performance benefits and without which out-of-order would be pointless. Yet these speculative instructions are also where the crux lies, because they create space for a whole series of attack scenarios (source: heise.de).

The three known vulnerability variants

“Meltdown”

Variant 1: “Rogue Data Cache Load” – (CVE-2017-5754)

This requires increased isolation of kernel memory, referred to as kernel page-table isolation (KPTI).
By running certain program code, cybercriminals can access the memories of various kernel users which they do not have permission to access.

“Spectre”

Variant 2: “Bounds Check Bypass” (CVE-2017-5753)
This vulnerability affects specific instruction sequences within compiled applications. Additional exploitation is possible, for example, through JavaScript weaknesses or browser attacks.

Variant 3: “Branch Target Injection” (CVE-2017-5715)
This is currently the basis for concern about “Cloud Virtualization” and “Hypervisor Bypass”, which can affect entire cloud systems. These vulnerabilities can be fixed either by a CPU microcode update from the CPU vendor or by applying a special software protection like “Retpoline”.

Have cybercriminals already exploited these vulnerabilities?

No actual cyber attacks are known to have been carried out to date.

What steps is Yokogawa taking?

Functional safety and security are top priorities for Yokogawa! Our cyber security experts are therefore carrying out detailed evaluations and tests to determine the risk level of these known vulnerabilities – “Meltdown” and “Spectre” – in our integrated manufacturing execution systems and security systems. Parallel to this, the patches currently available from Microsoft – for all CPUs since 1995 – are proactively being put to the acid test to check their compatibility both with Yokogawa’s own systems and with all of the most popular software and antivirus programs. These are essential to mitigate or rule out the risk of “nonconformity” in customer systems.

Security patches in the pipeline!

The patches verified by our cyber security experts will be made available in mid-February 2018.

Do you require support?

Feel free to contact us if you have any specific questions, or require support, regarding vulnerabilities in processors. We’d be happy to advise and accompany you on your path to a safe and secure plant.

If you’d like to learn more about security, click here.