Meltdown (security vulnerability)

Meltdown is a class of hardware-level security vulnerabilities discovered in 2018 that allows a low-privilege process to read arbitrary kernel memory — including passwords, cryptographic keys, and other sensitive data — by exploiting speculative execution in modern processors. The vulnerability exists not because of a software bug but because of a design decision in how CPUs optimize performance: speculative execution, the technique of executing instructions before it is known whether they are needed, leaves traces in the cache that can be measured by timing analysis. The security architecture of operating systems assumed that speculative execution was invisible to software. Meltdown proved that assumption false, and in doing so revealed that the boundary between hardware and software — long treated as a stable foundation for security — is itself a source of vulnerability.

Meltdown is not an isolated failure. It is a member of a family of vulnerabilities — including Spectre, Foreshadow, and ZombieLoad — that all arise from the same root cause: the performance optimizations of modern CPUs create side channels that leak information across the very boundaries the hardware was designed to enforce. The response — kernel page-table isolation, microcode updates, and eventually hardware redesigns — treats the symptoms while the disease remains: the security properties of the hardware are not formally verified and are not even fully understood by the engineers who implement them.