Meltdown Security Vulnerability

Last Updated : 29 Sep, 2022

What is Meltdown security vulnerability? Meltdown, also known as Rogue Data Cache Load, is a security vulnerability that affects microprocessors of the types Intel x86, IBM Power, and ARM, by allowing some malicious processes to read memory, even without authorization.
Exploiting race condition, this vulnerability allows a process to bypass the normal privilege check that prevents a process from accessing data belonging to other processes and the operating system which enables an unauthorized process to read data from any address that is mapped to the current process's memory space. Therefore, the data from an unauthorized address gets loaded into the CPU's cache, from where it can easily be execute by the processor, even if the privilege checker somehow identifies the rogue process trying to access other addresses in the RAM. It is also possible for the malicious process to effectively read any physical, kernel or any other process's mapped memory, even though it may not have the permission to do so. How does Meltdown exploitation work? Meltdown takes advantage of the following features inherent in CPU design:

Virtual Memory
Privilege levels
Instruction pipelining and speculative execution
CPU cache

The above features provide the basis of the way all the modern CPUs work, and are considered secure. However, meltdown takes advantage of how they interact with each other. The following points explain the exploitation mechanism:

The virtual address space of an operating system doesn't have privilege control checks in order to maximize efficiency. The control mechanism is entrusted with the CPU privilege control. Like every other process, the rogue process too, is assigned some address space here.

If a process tries reading from unauthorized memory, the read instruction will be scheduled and pipelined by the CPU. Before the instruction is allowed to produce any output, the privilege check will complete elsewhere. In the case of an unauthorized read, the execution unit will be told that the instruction failed the privilege check.

In the early stages of the instruction execution, the CPU's scheduler scheduled two events – a privilege check, and the first steps of executing the instruction. As part of that, while it was waiting for the privilege check to complete, the execution unit started by fetching the data. In the case of the rogue process, the data was from an unauthorized address, but it was still fetched by the memory controller during the initial stage of instruction execution, even if it was then discarded and abandoned when the privilege check completed and failed.

Despite the instruction failure, the data has already been requested by the execution unit and fetched by the memory controller, in order to be ready to process it, and although the execution unit discards the data upon privilege check failure, the CPU cache was in fact updated as an automatic part of fetching the data from memory, in case the same data might be needed shortly a second time. At this point, Meltdown kicks in.

By employing cache timing side channel attack, the rogue process can determine whether data from a specific address is held within the CPU cache, even if it cannot itself read the actual data from there.

If data from some address has been cached by the CPU then a second instruction to read that address will use the CPU cache for the purpose (fast), if not then the CPU would have to request the data to be read from memory (slower). The rogue process can use this difference in timing to detect which of these took place, and whether the address was already in the CPU cache. Meltdown can use it combined with other features of the CPU instruction set to gain full access to all mapped memory.

How have processor vendors addressed this vulnerability?

References

https://en.wikipedia.org/wiki/Meltdown_(security_vulnerability)

https://meltdownattack.com/