The world of computer security has started this new year with two serious and massive vulnerabilities of modern processors on the table: Meltdown and Specter. The first is the one we met yesterday, that design error of the Intel CPUs that implies having an open door to data from the system memory and suffering a possible slowdown of the equipment with the solution.

The second is Specter, another design flaw that turns out to be even worse for several reasons. Not only does it affect Intel’s processors, but it also extends to the AMD and ARM central processing units as Intel seemed to advance in its response last night; it is more difficult to mitigate, but also harder to exploit than Meltdown; and allows access to the memory of other applications.

Thanks to the information disseminated by security researchers who are part of Google’s Project Zero, the University of Technology of Graz, the University of Pennsylvania, the University of Maryland, the University of Adelaide and computer and / or security companies such as Cyberus , Rambus and Data61, we will take a closer look at what makes Meltdown and Specter similar and different, as well as the implications of both vulnerabilities.

To compromise the memory of the system to expose the memory of the applications

Yesterday we explained citing to The Register, the middle progressed little is known about the first of vulnerabilities, Meltdown, gathering different evidence published in recent days, how we could affect.

A program with bad intentions can read protected areas of the kerneltaking advantage of this vulnerability, the researchers assure. The processes in charge of launching applications of conventional users could observe, in an attack, what other processes of the system do in the memory, as well as to see another class of reserved information, including that of the operating system.

Meltdown breaks the most fundamental isolation between user applications and the operating system. […] If the computer has a vulnerable processor and runs an unpatched operating system, it is not safe to work with confidential information without the possibility of leaking information.

Every Intel processor that implements out-of-order execution is potentially affected. We would speak, according to the data released, of each of the processors launched by the company since 1995 , except Intel Itanium and Intel Atom before 2013. The researchers claim to have successfully tested Meltdown on generations of Intel processors launched in 2011 and not having I was able to verify that this particular problem also affects the ARM and AMD processors.

On the website they have published to detail their findings, experts emphasize that an attacker could obtain passwords stored in a credential or browser administrator, personal photos, emails, instant messages and even business-critical documents.

It is at this point that we find the essential difference between the two in terms of computer security. While Meltdown allows access to the information contained in the system memory, Specter provides input to the memory of other applications to extract information.

Specter breaks the isolation between different applications. It allows an attacker to cheat programs without errors, which follow best practices, to filter their secrets. In fact, the security controls of such best practices actually increase the attack surface and can make applications more susceptible to Specter.

In addition, this second vulnerability not noticed in the first information published yesterday implies all modern processors capable of keeping many instructions in flight are potentially vulnerable, including “practically all systems”. We are talking about the Intel CPUs, but also the AMD and ARM CPUs.

In fact, the researchers underline in a section of questions and answers the generalized affectation of Meltdown and Specter.

• Am I affected by the error?
• Without a doubt, yes.

Leaving aside the different consequences of both problems and their affectation, the third big difference is that for the first vulnerability, which affects Intel, there are software patches that mitigate or cancel their effects, but for Specter no. As we said, it is more difficult to exploit than Meltdown, but it is also more difficult to solve although certain known exploits that are based on the problems described now can be prevented .