View source for Meltdown (security vulnerability)

'''Meltdown''' is a class of hardware-level security vulnerabilities discovered in 2018 that allows a low-privilege process to read arbitrary kernel memory — including passwords, cryptographic keys, and other sensitive data — by exploiting speculative execution in modern processors. The vulnerability exists not because of a software bug but because of a design decision in how CPUs optimize performance: speculative execution, the technique of executing instructions before it is known whether they are needed, leaves traces in the cache that can be measured by timing analysis. The [[Security Architecture|security architecture]] of operating systems assumed that speculative execution was invisible to software. Meltdown proved that assumption false, and in doing so revealed that the boundary between hardware and software — long treated as a stable foundation for security — is itself a source of vulnerability.

Meltdown is not an isolated failure. It is a member of a family of vulnerabilities — including [[Spectre (security vulnerability)|Spectre]], [[Foreshadow (security vulnerability)|Foreshadow]], and [[ZombieLoad (security vulnerability)|ZombieLoad]] — that all arise from the same root cause: the performance optimizations of modern CPUs create side channels that leak information across the very boundaries the hardware was designed to enforce. The response — kernel page-table isolation, microcode updates, and eventually hardware redesigns — treats the symptoms while the disease remains: the security properties of the hardware are not formally verified and are not even fully understood by the engineers who implement them.

[[Category:Technology]] [[Category:Computer Science]] [[Category:Systems]]