{"id":74005,"date":"2018-01-08T08:23:45","date_gmt":"2018-01-08T16:23:45","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=74005"},"modified":"2023-10-27T14:03:24","modified_gmt":"2023-10-27T21:03:24","slug":"meltdown-and-spectre-what-apple-users-need-to-know","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/meltdown-and-spectre-what-apple-users-need-to-know\/","title":{"rendered":"Meltdown and Spectre: What Apple users need to know"},"content":{"rendered":"

\"Meltdown<\/p>\n

You’ve probably heard something about “Meltdown<\/strong>” and “Spectre<\/strong>,” perhaps even in the mainstream media, and you\u00a0likely\u00a0heard that it has something to do with an Intel security flaw.<\/p>\n

But do you know how it affects your<\/em> Apple devices<\/strong>\u2014your Mac, iPhone, iPad, iPod touch, Apple Watch, or Apple TV\u2014and what actions you may need to take to stay safe?<\/p>\n

Never fear, that’s why we’re here! It’s a complex problem, but we’ll break it down and share the main tidbits about these vulnerabilities you need to know as a user of Apple products.<\/p>\n

What\u00a0are Meltdown and Spectre?<\/h3>\n

On Monday, January 1, 2018, a developer blog, called “python sweetness,” brought to light<\/a>\u00a0an issue in which\u00a0“there is presently an embargoed security bug impacting apparently all contemporary CPU [central processing unit] architectures that implement virtual memory, requiring hardware changes to fully resolve.”<\/p>\n

\"\"The Register published an article<\/a>\u00a0the following day\u00a0that emphasized the design flaw with regard to Intel processors, and from there snowballed into a worldwide discussion about a serious flaw in Intel CPUs that had major security implications.<\/p>\n

Macs, along with the vast majority of the world’s Windows and Linux PCs, use Intel processors.<\/p>\n

As more information came to light in the subsequent days, it became clear that more than just Intel CPUs are affected; there are also implications for other processor architectures, including AMD processors as well as ARM-based processors like those\u00a0found in Apple’s iPhones and iPads.<\/p>\n

It turns out that Intel and a handful of software development giants, among them Apple, Microsoft, and the Linux kernel developers, have known about the design flaw since at least November 2017 and have been working behind the scenes to prepare for a coordinated public disclosure and remediation of the issue. (At least, that was the plan until “python sweetness” and The Register brought the issue out of obscurity and into the public spotlight.)<\/p>\n

\"\"<\/p>\n

“Meltdown” and “Spectre” are nicknames for techniques that can enable an attacker to access computer memory that shouldn’t be accessible; this is accomplished by abusing a technology called “speculative execution.”<\/p>\n

Speculative execution is a processing feature that enables computing devices to run faster by predicting what will happen next in an app, and preemptively working toward multiple possible outcomes all at once.<\/p>\n

The end result of leveraging Meltdown and Spectre could include leaks of sensitive data such as passwords and credit card information, among other things.<\/p>\n

What do all these names mean?<\/h3>\n

A vulnerability may be known by many names.<\/p>\n

Perhaps the broadest term for the vulnerabilities in question would be “speculative execution vulnerabilities.”<\/p>\n

“Meltdown<\/strong>” and “Spectre<\/strong>” are the main names that have caught on in association with this bug; each of these are\u00a0unique and will be described further in their own sections below.<\/p>\n

When the story broke, it was at first being discussed online under the name KPTI<\/strong> in reference to Kernel Page-table Isolation<\/a>\u00a0(formerly called KAISER<\/strong>), a feature of the Linux kernel that mitigates the Meltdown vulnerability.<\/p>\n

There’s also a not-safe-for-work nickname that was reportedly conceived by the Linux kernel team: F***WIT<\/strong> (which stands for “Forcefully Unmap Complete Kernel With Interrupt Trampolines”).<\/p>\n

You may also see references to “CVE” numbers associated with these bugs. CVE stands for Common Vulnerabilities and Exposures, and CVE numbers are used for the purpose of tracking the same bug across multiple vendors and media outlets, as bugs tend to be described in many different ways and may have various nicknames.<\/p>\n

What is Meltdown?<\/h3>\n

Meltdown<\/strong>\u00a0is the nickname for one of\u00a0two major categories of exploits at this time. It\u00a0may also be referred to as the “rogue data cache load” technique, or CVE-2017-5754<\/a>.<\/p>\n

Successful exploitation could allow an attacker’s code running in a user-privileged app to read kernel (superuser-privileged) memory.<\/p>\n

Apple\u00a0said<\/a>\u00a0that its own\u00a0analysis suggested that the Meltdown exploitation technique “has the most potential to be exploited”\u00a0as compared with the Spectre exploitation techniques.<\/p>\n

What is Spectre?<\/h3>\n

The other exploitation techniques are known collectively as Spectre<\/strong> (sometimes spelled Specter). The two techniques may be referred to as “bounds check bypass” or CVE-2017-5753<\/a>, and “branch target injection” or CVE-2017-5715<\/a>.<\/p>\n

From Apple’s public statement<\/a>:<\/p>\n

“Analysis of these techniques revealed that while they are extremely difficult to exploit, even by an app running locally on a Mac or iOS device, they can be potentially exploited in JavaScript running in a web browser. Apple will release an update for Safari on macOS and iOS in the coming days to mitigate these exploit techniques.”<\/p><\/blockquote>\n

In other words,\u00a0Web pages in an unpatched browser can potentially exploit Spectre.<\/p>\n

Is my Apple device safe from Meltdown?<\/h3>\n

If your Apple device is running one of the following operating systems, you’re already (at least partially) protected against Meltdown attacks:<\/p>\n