vSOC SPOT Report – Spectre and Meltdown

Overview

On January 1st, 2018 Intel disclosed a critical alert around a large variety of Intel CPUs that allows an attacker to read memory belonging to other processes. Further details from Google Project Zero, Cyberus Technology private researcher Paul Kocher, and various universities surfaced January 3, including white papers. The vulnerabilities are named Spectre and Meltdown. Numerous other names also circulated in the press and on social media, including Meldown [sic], KAISER, KPTI, and FUCKWIT [sic].

Spectre has been assigned CVEs CVE-2017-5753 and CVE-2017-5715. Meltdown has been assigned CVE CVE-2017-5754. Some elements of Spectre, at least for the moment, cannot be mitigated in software.

The flaws affect Intel CPUs produced after the original Pentium (P5 architecture), with the exception of Itanium and pre-2013 Atom CPUs, on all operating systems that run on the x86 and x86-64 architecture, including but not limited to Microsoft Windows, Linux, Mac OS X, and embedded systems using Intel CPUs.

AMD states its CPUs are immune to Meltdown but some researchers report Spectre works on AMD CPUs. AMD CPUs achieved a degree of acceptance in the 2005-2010 timeframe in enterprises but are much less common in enterprise environments than Intel.

Additionally, ARM has stated its high-end Cortex CPUs are vulnerable to Spectre. Apple uses ARM-based CPUs in its iPhone and iPad products but has not released a statement regarding their vulnerability or immunity to this flaw. Devices based on Google Android and Chrome OS also use ARM. Google has released patches but in some cases the patch has to be released by the device manufacturer and/or the carrier.

Linux vendor Red Hat states a the Spectre condition exists in IBM System Z, Power 8, and Power 9 CPUs.

This vulnerability was privately disclosed to Intel and operating system vendors, but security researchers working independently have developed proof of concept code. In a statement released on January 3, Intel stated it is working with AMD and ARM, as well as with major operating system vendors, on fixes.

Microsoft released emergency patches for supported versions of Windows on January 3, and is patching Azure on an accelerated schedule. Microsoft has not stated if end-of-life systems such as Windows Vista, Windows XP, and Windows Server 2003 will be included. Apple included fixes in macOS 10.13.2, and plans more fixes in macOS 10.13.3 by the end of the month. Google addressed the issue on Android and Chrome OS in its January 2018 security patch.

Patches for Linux are in work. Amazon has released patches for Amazon Linux. Customers can roll the patch to existing AMIs; new AMIs automatically have the patch in place. Red Hat has released patches for some versions of Red Hat Enterprise Linux, with patches for the other supported versions in work. Intel’s initial recommendation regarding Linux was incomplete.

Security researcher Erik Bosman released proof of concept code on Twitter on January 3. The original researchers will release their proof of concept code after security patches are released, including code that demonstrates stealing passwords.

Technical Overview

KPTI (Kernel Page Table Isolation) is a technique to isolate kernel code from userspace, so that the code is accessible, but only indirectly. It is a key security feature in modern CPUs and operating systems. Userspace is able to make calls to the kernel even though it does not know where it exists in memory. KAISER refers to a flaw that permits an attacker to defeat these measures and jump from CPU ring 3 (where user applications run) to ring 0 (where the kernel runs).

The exploit works by taking advantage of speculative execution. When faced with a branch in program flow, modern Intel CPUs will execute both possibilities, so it has the results ready ahead of time, and simply discard the result it didn’t need. Under some conditions, such speculative code runs with fewer security measures than normal code. The exploits take advantage of this unusual condition to bypass the CPU’s normal security measures. There are three conditions under which this can occur, not all of which are present in all affected CPUs.

Early reports had suggested this was a way to overwrite code. Intel has stated it only makes it possible for a process to read memory belonging to a different process.

Potential Impact

This vulnerability can be potentially exploited to defeat ASLR and KPTI on affected systems and read memory contents belonging to other processes running on the machine. At this point, the most useful scenario for an attacker would be to use it to steal passwords, credit card numbers, or other sensitive but succinct data from memory. On desktops and laptops, it can be exploited remotely via JavaScript residing on a web page. It could also be used in cloud environments to cross over into other virtual machines and steal data belonging to other customers.

The patches for this flaw may prove to be unpopular due to early reports stating to expect performance hits ranging from 5-30 percent. Reports from the field indicate 20% is a more common worst-case scenario on database and web servers. On desktops, the performance impact generally is minimal.

What Should You Do

Having a complete inventory of IT systems is critical for addressing vulnerabilities such as this one, including hardware make and model, CPU architecture, and operating system.

Scan your network for CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754. Apply any applicable patches. Keep in mind some fixes will not be available until later in the month. If your vulnerability management solution permits, scan your Mobile Device Management platform to ensure you are running post-January 2018 versions of Android. Workstations and virtual machines in cloud environments, which have the greatest exposure to the outside world, should have the highest priority when deploying patches. Servers running on virtual infrastructure under your control will be harder to exploit.

There are some caveats to patching Windows for this vulnerability. A Microsoft article on compatibility issues between this patch and certain third-party antivirus solutions is included in the Supporting Information section at the end of this document. GuidePoint recommends you confirm with your antivirus vendor that its solution is compatible with Microsoft’s update for Spectre and Meltdown. As GuidePoint learns more regarding antivirus compatibility or lack thereof, we will post updates on our blog at https://www.guidepointsecurity.com/blog/.

Furthermore, under some conditions, the update for Windows 10 can throw a false error message stating that it failed when it succeeded. Follow up patching efforts with scanning from your vulnerability management solution to validate that patches actually did apply and are no longer vulnerable.

Slowdowns, although initially overstated, still have the potential to occur. The effect on workstations will be minimal. Servers that perform heavy I/O, such as web servers and databases, will incur more significant performance hits. GuidePoint recommends testing any applicable patches for performance impact before upgrading web farms. Be prepared to update software such as Apache that may need revisions to work around performance issues introduced by these security updates.

GuidePoint also recommends you advise your employees to update their personal computers and devices, with the caveat that your IT department is not responsible for providing support. Microsoft provides free support for home users of Windows who experience difficulty related to applying security patches.

References

• http://news.softpedia.com/news/billions-of-devices-at-risk-of-attacks-because-of-two-critical-hardware-bugs-519213.shtml
• https://mspoweruser.com/meltdown-spectre-chip-hack-gets-name-emergency-patch-official-statement-microsoft/
• https://newsroom.intel.com/news/intel-responds-to-security-research-findings/
• https://www.guidepointsecurity.com/wp-content/uploads/2018/01/spectre.pdf
• https://www.guidepointsecurity.com/wp-content/uploads/2018/01/meltdown.pdf
• http://www.securityweek.com/mitigations-prepared-critical-flaw-intel-cpus
• https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/
• https://access.redhat.com/security/vulnerabilities/speculativeexecution
• https://support.microsoft.com/en-us/help/4072699/important-information-regarding-the-windows-security-updates-released