1<!DOCTYPE html> 2<html lang="en"> 3 <head> 4 <meta charset="utf-8"> 5 <meta http-equiv="X-UA-Compatible" content="IE=edge"> 6 <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0" /> 7 <meta name="description" content=""> 8 9 <title>Meltdown and Spectre</title> 10 11 <link href="https://fonts.googleapis.com/css?family=Montserrat:300,400,500,600" rel="stylesheet"> 12 <link rel="stylesheet" type="text/css" href="//fonts.googleapis.com/css?family=Open+Sans:400,bold,900,600"> 13 <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta.2/css/bootstrap.min.css" integrity="sha384-PsH8R72JQ3SOdhVi3uxftmaW6Vc51MKb0q5P2rRUpPvrszuE4W1povHYgTpBfshb" crossorigin="anonymous"> 14
14<script defer src="https://use.fontawesome.com/releases/v5.0.2/js/all.js"></script>
14 15 16 <link rel="stylesheet" href="meltdown.min.css" type='text/css'> 17 18 <link rel="shortcut icon" href="favicon.ico"> 19 20 <!-- HTML5 shim and Respond.js IE8 support of HTML5 elements and media queries --> 21 <!--[if lt IE 9]> 22
22<script src="//oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
22 23
23<script src="//oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js"></script>
23 24 <![endif]--> 25 26 </script>
26 27 </head> 28 29 <body> 30 <div class="container"> 31 <div class="row"> 32 <div class="col-lg-12 col-md-12 col-sm-12 text-justify"> 33 <h1 class="display-4 text-left">Meltdown and Spectre</h1> 34 <p class="lead">Vulnerabilities in modern computers leak passwords and sensitive data.</p> 35 <br /> 36 <p>Meltdown and Spectre exploit critical vulnerabilities in modern <abbr style="cursor:help;" title="The main part of every computer">processors</abbr>. 37 These hardware vulnerabilities allow programs to steal data which is currently processed on the computer. 38 While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs. 39 This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents. </p> 40 <p>Meltdown and Spectre work on personal computers, mobile devices, and in the cloud. 41 Depending on the cloud provider's infrastructure, it might be possible to steal data from other customers.</p> 42 </div> 43 </div> 44 <div class="row"> 45 <div class="card-deck"> 46 <div class="card meltdown" id="meltdown"> 47 <div class="logo-wrapper"> 48 <center><img class="card-img-top" src="images/meltdown.min.svg" alt="Meltdown"/></center> 49 </div> 50 <div class="card-body"> 51 <h4 class="card-title">Meltdown</h4> 52 <p class="card-text"> 53 <p>Meltdown breaks the most fundamental isolation between user applications and the operating system. 54 This attack allows a program to access the memory, and thus also the secrets, of other programs and the operating system. </p> 55 <p>If your computer has a vulnerable processor and runs an unpatched operating system, it is not safe to work with sensitive information without the chance of leaking the information. This applies both to personal computers as well as cloud infrastructure. Luckily, there are <a href="#faq-fix">software patches against Meltdown</a>.</p> 56 </p> 57 </div> 58 <div class="card-footer"> 59 <a href="https://meltdownattack.com/meltdown.pdf" class="btn btn-primary btn-lg btn-block"><i class="fa fa-download d-print-none"></i> Meltdown Paper</a> 60 <div class="row"> 61 <div class="col-lg-6 col-md-6 col-sm-12"> 62 <a href="meltdown.bib" class="btn btn-primary btn-lg btn-block"><i class="fa fa-quote-right d-print-none"></i> Cite</a> 63 </div> 64 <div class="col-lg-6 col-md-6 col-sm-12"> 65 <a href="https://arxiv.org/abs/1801.01207" target="_blank" class="btn btn-primary btn-lg btn-block"><i class="fa fa-archive d-print-none"></i> arXiv</a> 66 </div> 67 </div> 68 </div> 69 </div> 70 71 72 <div class="card spectre" id="spectre"> 73 <div class="logo-wrapper"> 74 <center><img class="card-img-top" src="images/spectre.min.svg" alt="Spectre"/></center> 75 </div> 76 <div class="card-body"> 77 <h4 class="card-title">Spectre</h4> 78 <p class="card-text"> 79 <p>Spectre breaks the isolation between different applications. 80 It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. 81 In fact, the safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre 82 </p> 83 <p>Spectre is harder to exploit than Meltdown, but it is also harder to mitigate. 84 <a href="#faq-fix">However, it is possible to prevent specific known exploits based on Spectre through software patches.</a> 85 </p> 86 </div> 87 <div class="card-footer"> 88 <a href="https://spectreattack.com/spectre.pdf" class="btn btn-primary btn-lg btn-block"><i class="fa fa-download d-print-none"></i> Spectre Paper</a> 89 <div class="row"> 90 <div class="col-lg-6 col-md-6 col-sm-12"> 91 <a href="spectre.bib" class="btn btn-primary btn-lg btn-block"><i class="fa fa-quote-right d-print-none"></i> Cite</a> 92 </div> 93 <div class="col-lg-6 col-md-6 col-sm-12"> 94 <a href="https://arxiv.org/abs/1801.01203" target="_blank" class="btn btn-primary btn-lg btn-block"><i class="fa fa-archive d-print-none"></i> arXiv</a> 95 </div> 96 </div> 97 </div> 98 </div> 99 </div> 100 </div> 101 102 <div class="row"> 103 <div class="col-lg-6 col-md-6 col-sm-12"> 104 <h2 id="meltdown-reported">Who reported Meltdown?</h2> 105 <p> 106 Meltdown was independently discovered and reported by three teams: 107 <ul> 108 <li><a href="https://twitter.com/tehjh" target="_blank">Jann 109 Horn</a> (<a class="company" href="https://googleprojectzero.blogspot.com" target="_blank">Google Project Zero</a>),</li> 110 <li><a href="mailto:[email protected]">Werner Haas</a>, <a href="mailto:[email protected]">Thomas Prescher</a> (<a class="company" href="https://www.cyberus-technology.de" target="_blank">Cyberus Technology</a>), </li> 111 <li><a href="https://gruss.cc" target="_blank">Daniel Gruss</a>, <a 112 href="https://mlq.me" target="_blank">Moritz Lipp</a>, <a href="https://www.iaik.tugraz.at/content/about_iaik/people/mangard_stefan/" target="_blank">Stefan Mangard</a>, <a href="https://misc0110.net/" target="_blank">Michael Schwarz</a> (<a class="company" href="https://www.iaik.tugraz.at" target="_blank">Graz University of Technology</a>)</li> 113 </ul> 114 </p> 115 </div> 116 <div class="col-lg-6 col-md-6 col-sm-12"> 117 <h2 id="spectre-reported">Who reported Spectre?</h2> 118 <p> 119 Spectre was independently discovered and reported by two people: 120 <ul> 121 <li><a href="https://twitter.com/tehjh" target="_blank">Jann 122 Horn</a> (<a class="company" href="https://googleprojectzero.blogspot.com" target="_blank">Google Project Zero</a>) and</li> 123 <li><a href="https://paulkocher.com" target="_blank">Paul Kocher</a> in collaboration with, in alphabetical order, 124 <a href="https://www.cis.upenn.edu/~danielg3/" target="_blank">Daniel Genkin</a> (<a class="company" href="https://www.upenn.edu/" target="_blank">University of Pennsylvania</a> and <a class="company" href="https://www.umd.edu" target="_blank">University of Maryland</a>), <a href="https://www.shiftleft.org/" target="_blank">Mike Hamburg</a> (<a class="company" href="https://www.rambus.com" target="_blank">Rambus</a>), <a 125 href="https://mlq.me" target="_blank">Moritz Lipp</a> (<a class="company" href="https://www.iaik.tugraz.at" target="_blank">Graz University of Technology</a>), and <a href="https://cs.adelaide.edu.au/~yval">Yuval Yarom</a> (<a class="company" href="https://www.adelaide.edu.au/" target="_blank">University of Adelaide</a> and <a class="company" href="https://www.data61.csiro.au/" target="_blank">Data61</a>) 126 </li> 127 </ul> 128 </p> 129 </div> 130 </div> 131 132 133 <br/> 134 <hr /> 135 136 <div class="row"> 137 <div class="col-lg-12 col-md-12 col-sm-12 faq"> 138 <h2 id="faq"><a href="#faq">Questions & Answers</a></h2> 139 <h4 id="faq-affected"><a href="#faq-affected">Am I affected by the vulnerability?</a></h4> 140 <p>Most certainly, yes.</p> 141 142 <h4 id="faq-detect"><a href="#faq-detect">Can I detect if someone has exploited Meltdown or Spectre against me?</a></h4> 143 <p>Probably not. The exploitation does not leave any traces in traditional log files.</p> 144 145 <h4 id="faq-antivirus"><a href="#faq-antivirus">Can my antivirus detect or block this attack?</a></h4> 146 <p>While possible in theory, this is unlikely in practice. Unlike usual malware, Meltdown and
146Spectre are hard to distinguish from regular benign applications. However, your antivirus may detect malware which uses the attacks by comparing binaries after they become known.</p> 147 148 <h4 id="faq-leaked"><a href="#faq-leaked">What can be leaked?</a></h4> 149 <p>If your system is affected, our proof-of-concept exploit can read the memory content of your computer. This may include passwords and sensitive data stored on the system.</p> 150 151 <h4 id="faq-wild"><a href="#faq-wild">Has Meltdown or Spectre been abused in the wild?</a></h4> 152 <p>We don't know. </p> 153 154 <h4 id="faq-fix"><a href="#faq-fix">Is there a workaround/fix?</a></h4> 155 <p>There are patches against Meltdown for Linux (<a href="https://lwn.net/Articles/738975/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> KPTI (formerly KAISER)</a>), Windows, <!--(<a href="#">TODO</a>)--> and OS X. <!--(<a href="#">TODO</a>)--> 156 There is also work to harden software against future exploitation of Spectre, respectively to patch software after exploitation through Spectre (<a href="http://lists.llvm.org/pipermail/llvm-commits/Week-of-Mon-20180101/513630.html" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> LLVM patch</a>, <a href="https://blogs.msdn.microsoft.com/vcblog/2018/01/15/spectre-mitigations-in-msvc/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> MSVC</a>, <a href="https://github.com/ARM-software/speculation-barrier" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> ARM speculation barrier header</a>).</p> 157 158 <h4 id="faq-systems-meltdown"><a href="#faq-systems-meltdown">Which systems are affected by Meltdown?</a></h4> 159 <p>Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether AMD processors are also affected by Meltdown. <a href="https://developer.arm.com/support/security-update" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> According to ARM</a>, some of their processors are also affected.</p> 160 161 <h4 id="faq-systems-spectre"><a href="#faq-systems-spectre">Which systems are affected by Spectre?</a></h4> 162 <p>Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors.</p> 163 164 <h4 id="faq-cloud"><a href="#faq-cloud">Which cloud providers are affected by Meltdown?</a></h4> 165 <p>Cloud providers which use Intel CPUs and <abbr title="Xen paravirtualization">Xen PV</abbr> as virtualization without having patches applied. 166 Furthermore, cloud providers without real hardware virtualization, relying on containers that share one kernel, such as Docker, LXC, or OpenVZ are affected.</p> 167 168 <h4 id="faq-meltdown-vs-spectre"><a href="#faq-meltdown-vs-spectre">What is the difference between Meltdown and Spectre?</a></h4> 169 <p>Meltdown breaks the mechanism that keeps applications from accessing arbitrary system memory. 170 Consequently, applications can access system memory. 171 Spectre tricks other applications into accessing arbitrary locations in their memory. 172 Both attacks use side channels to obtain the information from the accessed memory location. 173 For a more technical discussion we refer to the papers (<a href="https://meltdownattack.com/meltdown.pdf"><i class="fa fa-download d-print-none"></i> Meltdown</a> and <a href="https://spectreattack.com/spectre.pdf"><i class="fa fa-download d-print-none"></i> Spectre</a>)</p> 174 175 <h4 id="faq-why-meltdown"><a href="#faq-why-meltdown">Why is it called Meltdown?</a></h4> 176 <p>The vulnerability basically melts security boundaries which are normally enforced by the hardware.</p> 177 178 <h4 id="faq-why-spectre"><a href="#faq-why-spectre">Why is it called Spectre?</a></h4> 179 <p>The name is based on the root cause, speculative execution. As it is not easy to fix, it will haunt us for quite some time.</p> 180 181 <h4 id="faq-papers"><a href="#faq-papers">
181Is there more technical information about Meltdown and Spectre?</a></h4> 182 <p>Yes, there is an <a href="https://arxiv.org/abs/1801.01207"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> academic paper</a> and <a href="http://blog.cyberus-technology.de/posts/2018-01-03-meltdown.html" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> a blog post</a> about Meltdown, and an <a href="https://arxiv.org/abs/1801.01203"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> academic paper</a> about Spectre. Furthermore, there is a <a href="https://googleprojectzero.blogspot.co.at/2018/01/reading-privileged-memory-with-side.html" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Google Project Zero blog entry</a> about both attacks.</p> 183 184 <h4 id="faq-cve-spectre"><a href="#faq-cve-spectre">What are CVE-2017-5753 and CVE-2017-5715?</a></h4> 185 <p>CVE-2017-5753 and CVE-2017-5715 are the official references to Spectre. <abbr title="Common Vulnerabilities and Exposures">CVE</abbr> is the Standard for Information Security Vulnerability Names maintained by MITRE.</p> 186 187 <h4 id="faq-cve-meltdown"><a href="#faq-cve-meltdown">What is the CVE-2017-5754?</a></h4> 188 <p>CVE-2017-5754 is the official reference to Meltdown. <abbr title="Common Vulnerabilities and Exposures">CVE</abbr> is the Standard for Information Security Vulnerability Names maintained by MITRE.</p> 189 190 <h4 id="faq-demo-video"><a href="#faq-demo-video">Can I see Meltdown in action?</a></h4> 191 <p> 192 <div class="row"> 193 <div class="col-lg-6 col-md-6 col-sm-12"> 194 <div class="embed-responsive embed-responsive-16by9"> 195 <iframe class="embed-responsive-item" src="https://www.youtube.com/embed/bReA1dvGJ6Y" allowfullscreen></iframe> 196 </div> 197 </div> 198 <div class="col-lg-6 col-md-6 col-sm-12"> 199 <div class="embed-responsive embed-responsive-16by9"> 200 <iframe class="embed-responsive-item" src="https://www.youtube.com/embed/RbHbFkh6eeE" allowfullscreen></iframe> 201 </div> 202 </div> 203 </div> 204 <div class="row"> 205 <div class="col-lg-6 col-md-6 col-sm-12"> 206 <div class="embed-responsive embed-responsive-16by9"> 207 <iframe class="embed-responsive-item" src="https://www.youtube.com/embed/kwnh7q356Jk" allowfullscreen></iframe> 208 </div> 209 </div> 210 <div class="col-lg-6 col-md-6 col-sm-12"> 211 <div class="embed-responsive embed-responsive-16by9"> 212 <iframe class="embed-responsive-item" src="https://www.youtube.com/embed/L1N1P2zxaZE" allowfullscreen></iframe> 213 </div> 214 </div> 215 </div> 216 217 218 <br /> 219 </p> 220 221 <h4 id="faq-logo"><a href="#faq-logo">Can I use the logo?</a></h4> 222 <p>Both the Meltdown and Spectre logo are free to use, rights waived via <a href="http://creativecommons.org/publicdomain/zero/1.0/"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> CC0</a>. Logos are designed by <a href="https://vividfox.me/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Natascha Eibl</a>.</p> 223 <table id="logos"> 224 <tr><td></td><th>Logo</th><th>Logo with text</th><th>Code illustration</th></tr> 225 <tr> 226 <th>Meltdown</th> 227 <td> 228 <a href="meltdown.png"><i class="fa fa-download d-print-none"></i> PNG</a> / 229 <a href="meltdown.svg"><i class="fa fa-download d-print-none"></i> SVG</a> 230 </td> 231 <td> 232 <a href="meltdown-text.png"><i class="fa fa-download d-print-none"></i> PNG</a> / 233 <a href="meltdown-text.svg"><i class="fa fa-download d-print-none"></i> SVG</a> 234 </td> 235 <td> 236 <a href="meltdown-code.png"><i class="fa fa-download d-print-none"></i> PNG</a> / 237 <a href="meltdown-code.svg"><i class="fa fa-download d-print-none"></i> SVG</a> 238 </td> 239 </tr> 240 <tr> 241 <th>Spectre</th> 242 <td> 243 <a href="spectre.png"><i class="fa fa-download d-print-none"></i> PNG</a> /
244 <a href="spectre.svg"><i class="fa fa-download d-print-none"></i> SVG</a> 245 </td> 246 <td> 247 <a href="spectre-text.png"><i class="fa fa-download d-print-none"></i> PNG</a> / 248 <a href="spectre-text.svg"><i class="fa fa-download d-print-none"></i> SVG</a> 249 </td> 250 <td> 251 <a href="spectre-code.png"><i class="fa fa-download d-print-none"></i> PNG</a> / 252 <a href="spectre-code.svg"><i class="fa fa-download d-print-none"></i> SVG</a> 253 </td> 254 </tr> 255 </table> 256 <br /> 257 </tr> 258 </table> 259 </p> 260 261 <h4 id="faq-code"><a href="#faq-code">Is there a proof-of-concept code?</a></h4> 262 <p>Yes, there is a <a href="https://github.com/IAIK/meltdown" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> GitHub repository</a> containing test code for Meltdown.</p> 263 264 265 <h4 id="faq-advisory"><a href="#faq-advisory">Where can I find official infos/security advisories of involved/affected companies?</a></h4> 266 <p> 267 <table id="logos"> 268 <tr><td></td><th>Link</th></tr> 269 <tr> 270 <th>Intel</th> 271 <td> 272 <a href="https://security-center.intel.com/advisories.aspx" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Advisory</a> / <a href="https://newsroom.intel.com/news/intel-responds-to-security-research-findings/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Newsroom</a> / <a href="https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Whitepaper</a> 273 </td> 274 </tr> 275 <th>ARM</th> 276 <td> 277 <a href="https://developer.arm.com/support/security-update" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Update</a> 278 </td> 279 </tr> 280 <tr> 281 <th>AMD</th> 282 <td> 283 <a href="https://www.amd.com/en/corporate/speculative-execution" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Information</a> 284 </td> 285 </tr> 286 <tr> 287 <th>RISC-V</th> 288 <td> 289 <a href="https://riscv.org/2018/01/more-secure-world-risc-v-isa/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Blog</a> 290 </td> 291 </tr> 292 <tr> 293 <th>NVIDIA</th> 294 <td> 295 <a href="http://nvidia.custhelp.com/app/answers/detail/a_id/4611/~/security-bulletin%3A-nvidia-gpu-display-driver-security-updates-for-speculative" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Bulletin</a> / <a href="https://www.nvidia.com/en-us/product-security/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Product Security</a> 296 </td> 297 </tr> <tr> 298 <th>Microsoft</th> 299 <td> 300 <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Guidance</a> / <a href="https://support.microsoft.com/en-us/help/4072699/important-information-regarding-the-windows-security-updates-released" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Information regarding anti-virus software</a> / 301 <a href="https://azure.microsoft.com/en-us/blog/securing-azure-customers-from-cpu-vulnerability/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Azure Blog</a> /
302 <a href="https://support.microsoft.com/en-us/help/4073119/protect-against-speculative-execution-side-channel-vulnerabilities-in" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Windows (Client)</a> / <a href="https://support.microsoft.com/en-us/help/4072698/windows-server-guidance-to-protect-against-the-speculative-execution" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Windows (Server)</a> 303 </td> 304 </tr> 305 <tr> 306 <th>Amazon</th> 307 <td> 308 <a href="https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Bulletin</a> 309 </td> 310 </tr> 311 <tr> 312 <th>Google</th> 313 <td> 314 <a href="https://googleprojectzero.blogspot.co.at/2018/01/reading-privileged-memory-with-side.html" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Project Zero Blog</a> / 315 <a href="https://blog.google/topics/google-cloud/what-google-cloud-g-suite-and-chrome-customers-need-know-about-industry-wide-cpu-vulnerability/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Need to know</a> 316 </td> 317 </tr> 318 <tr> 319 <th>Android</th> 320 <td> 321 <a href="https://source.android.com/security/bulletin/2018-01-01" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Bulletin</a> 322 </td> 323 </tr> 324 <tr> 325 <th>Apple</th> 326 <td> 327 <a href="https://support.apple.com/en-us/HT208394" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Apple Support</a> 328 </td> 329 </tr> 330 <tr> 331 <th>Lenovo</th> 332 <td> 333 <a href="https://support.lenovo.com/at/de/solutions/len-18282" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Advisory</a> 334 </td> 335 </tr> 336 <tr> 337 <th>IBM</th> 338 <td> 339 <a href="https://www.ibm.com/blogs/psirt/potential-cpu-security-issue/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Blog</a> 340 </td> 341 </tr> 342 <tr> 343 <th>Dell</th> 344 <td> 345 <a href="http://www.dell.com/support/article/at/de/atbsdt1/sln308587/microprocessor-side-channel-attacks--cve-2017-5715--cve-2017-5753--cve-2017-5754---impact-on-dell-products?lang=en" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Knowledge Base</a> / <a href="http://www.dell.com/support/article/at/de/atbsdt1/sln308588/microprocessor-side-channel-attacks--cve-2017-5715--cve-2017-5753--cve-2017-5754---impact-on-dell-emc-products--dell-enterprise-servers--storage-and-networking-?lang=en" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Knowledge Base (Server)</a> 346 </td> 347 </tr> 348 <tr> 349 <th>Hewlett Packard Enterprise</th> 350 <td> 351 <a href="http://h22208.www2.hpe.com/eginfolib/securityalerts/SCAM/Side_Channel_Analysis_Method.html" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Vulnerability Alert</a> 352 </td> 353 </tr> 354 <tr> 355 <th>HP Inc.</th> 356 <td> 357 <a href="https://support.hp.com/document/c05869091" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Bulletin</a> 358 </td> 359 </tr> 360 <tr> 361 <th>Huawei</th> 362 <td> 363 <a href="http://www.huawei.com/en/psirt/security-notices/huawei-sn-20180104-01-intel-en" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Notice</a> 364 </td> 365 </tr> 366 <tr> 367 <th>Synology</th> 368 <td>
369 <a href="https://www.synology.com/en-us/support/security/Synology_SA_18_01" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Advisory</a> 370 </td> 371 </tr> <tr> 372 <th>Cisco</th> 373 <td> 374 <a href="https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannel" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Advisory</a> 375 </td> 376 </tr> 377 <tr> 378 <th>F5</th> 379 <td> 380 <a href="https://support.f5.com/csp/article/K91229003" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Advisory</a> 381 </td> 382 </tr> 383 <tr> 384 <th>Mozilla</th> 385 <td> 386 <a href="https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Blog</a> 387 </td> 388 </tr> 389 <tr> 390 <th>Red Hat</th> 391 <td> 392 <a href="https://access.redhat.com/security/vulnerabilities/speculativeexecution" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Vulnerability Response</a> / 393 <a href="https://access.redhat.com/articles/3307751" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Performance Impacts</a> 394 </td> 395 </tr> 396 <tr> 397 <th>Debian</th> 398 <td> 399 <a href="https://security-tracker.debian.org/tracker/CVE-2017-5754" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Tracker</a> 400 </td> 401 </tr> 402 <tr> 403 <th>Ubuntu</th> 404 <td> 405 <a href="https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Knowledge Base</a> 406 </td> 407 </tr> 408 <tr> 409 <th>SUSE</th> 410 <td> 411 <a href="https://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Vulnerability Response</a> 412 </td> 413 </tr> 414 <tr> 415 <th>Fedora</th> 416 <td> 417 <a href="https://fedoramagazine.org/protect-fedora-system-meltdown/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Kernel update</a> 418 </td> 419 </tr> 420 <tr> 421 <th>Qubes</th> 422 <td> 423 <a href="https://www.qubes-os.org/news/2018/01/04/xsa-254-meltdown-spectre/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Announcement</a> 424 </td> 425 </tr> 426 <tr> 427 <th>Fortinet</th> 428 <td> 429 <a href="https://fortiguard.com/psirt/FG-IR-18-002" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Advisory</a> 430 </td> 431 </tr> 432 <th>NetApp</th> 433 <td> 434 <a href="https://security.netapp.com/advisory/ntap-20180104-0001/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Advisory</a> 435 </td> 436 </tr> 437 <tr> 438 <th>LLVM</th> 439 <td> 440 <a href="http://lists.llvm.org/pipermail/llvm-commits/Week-of-Mon-20180101/513630.html" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Spectre (Variant #2) Patch</a> / 441 <a href="https://reviews.llvm.org/D41760" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Review __builtin_load_no_speculate</a> / 442 <a href="https://reviews.llvm.org/D41761" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Review llvm.nospeculateload</a> 443 </td> 444 </tr> 445 <tr> 446 <th>CERT</th> 447 <td> 448 <a href="http://www.kb.cert.org/vuls/id/584653" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Vulnerability Note</a> 449 </td> 450 </tr> 451 <tr> 452 <th>MITRE</th> 453 <td> 454 <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5715"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> CVE-2017-5715</a> / <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5753"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> CVE-2017-5753</a> / <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5754"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> CVE-2017-5754</a> 455 </td> 456 </tr> 457 <tr> 458 <th>VMWare</th> 459 <td> 460 <a href="https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Advisory</a> / <a href="https://blogs.vmware.com/security/2018/01/vmsa-2018-0002.html" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Blog</a> 461 </td> 462 </tr> 463 <tr> 464 <th>Citrix</th> 465 <td> 466 <a href="https://support.citrix.com/article/CTX231399" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Bulletin</a> / 467 <a href="https://support.citrix.com/article/CTX231390" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Bulletin (XenServer)</a> 468 </td> 469 </tr> 470 <tr> 471 <th>Xen</th> 472 <td> 473 <a href="https://xenbits.xen.org/xsa/advisory-254.html" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> Security Advisory (XSA-254)</a> / <a href="https://blog.xenproject.org/2018/01/04/xen-project-spectremeltdown-faq/" target="_blank"><i class="fa fa-sm fa-external-link-alt d-print-none"></i> FAQ</a> 474 </td> 475 </tr> 476 </table> 477 <br /> 478 </tr> 479 </table> 480 </p> 481 482 </div> 483 </div> 484 485 <br/> 486 <hr /> 487 488 <div class="row"> 489 <div class="col-lg-12 col-md-12 col-sm-12 acknowledgements text-justify"> 490 <h2 id="acknowledgements">Acknowledgements</h2> 491 492 <p>We would like to thank <a class="company" target="_blank" href="https://intel.com">Intel</a> for awarding us with a bug bounty for the responsible disclosure process, and their professional handling of this issue through communicating a clear timeline and connecting all involved researchers. 493 Furthermore, we would also thank <a class="company" target="_blank" href="https://arm.com">ARM</a> for their fast response upon disclosing the issue.</p> 494 495 <p>This work was supported in part by the European Research Council (ERC) under the European Unionâs Horizon 2020 research and innovation programme (grant agreement No 681402).</p> 496 497 <p>This work was supported in part by NSF awards #1514261 and #1652259, financial assistance award 70NANB15H328 from the U.S. Department of Commerce, National Institute of Standards and Technology, the 2017-2018 Rothschild Postdoctoral Fellowship, and the Defense Advanced Research Project Agency (DARPA) under Contract #FA8650-16-C-7622.</p> 498 </div> 499 </div> 500 </div> 501 502 <footer class="container"> 503 <div class="row"> 504 <div class="col-12"> 505 <div class="d-flex flex-row justify-content-between copyright"> 506 <div class="p-2"> 507 <p> 508 © 2018 Graz University of Technology. All Rights Reserved. 509 </p> 510 </div> 511 <div class="p-2"> 512 <p>System hosted at Graz University of Technology | <a href="https://www.tugraz.at/en/about-this-page/legal-notice" target="_blank">Legal Notice</a></p> 513 </div> 514 </div> 515 </div> 516 </div> 517 </footer> 518 </body> 519</html> 520
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.