Tag Archives: ARM

Protecting Against Spectre 1.1 and 1.2

Earlier this month, 2 security researchers disclosed details of 2 further vulnerabilities within Intel and ARM CPUs that have been named Spectre  1.1 (CVE-2018-3693) and 1.2 (no CVE at this time).

If an attacker exploited these vulnerabilities what would be the outcome?
Fortunately while these vulnerabilities potentially affect billions of CPUs, they rely on an attacker already having access to an affected computer system in order to exploit them. If exploited by an attacker Spectre 1.1 allows an them to retrieve data (which may include sensitive data) from previously secured CPU memory segments by allowing the writing of an execution of malicious code as a result of overflowing (defined) these memory segments.

For Spectre 1.2; exploitation allows normally read only CPU memory segments to be written over. In more detail, the security researchers describe the effects of this as follows “In a Spectre1.2 attack, speculative stores are allowed to overwrite read-only data, code pointers, and code metadata, including vtables, GOT/IAT, and control-flow mitigation metadata. As a result, sandboxing that depends on hardware enforcement of read-only memory is rendered ineffective.”

How can I protect myself from these vulnerabilities?
For ARM CPUs mainly found in smartphones and other smart devices; ARM’s security advisory provides guidance on determining if you have a vulnerable CPU and which vendor to refer to if your CPU is found to be vulnerable.

For Intel CPUs, at this time they are advising to continue to check with the vendors of the operating system for the affected device with the Intel CPU e.g. Apple macOS, Linux and Microsoft.

While such updates are not yet available; in the meantime please continue to exercise standard vigilance; e.g. don’t click on suspicious links received within emails, social media, via chat applications etc. Don’t open attachments you weren’t expecting within an email (even if you know the person; since their email account or device they access their email may have been compromised) and download updates for your software and devices from trusted sources e.g. the software/device vendors.

I will update this post as more information on these vulnerabilities becomes available and as they are resolved by affected vendors.

Thank you.

Vendors Respond to Spectre NG Vulnerabilities

Update: 24th July 2018
I have updated the list of vendor responses below to include further Red Hat versions and CentOS:

Red Hat Enterprise Linux 7:

CentOS 6:

CentOS 7:

Update: 19th June 2018
Last Wednesday, the security news and troubleshooting website BleepingComputer published a table detailing the complete list of updates required to mitigate the Meltdown, Spectre and SpectreNG (also known as Spectre variant 4) vulnerabilities for all recent versions of Windows. This is very useful because I realise my previous blog post on Meltdown and Spectre was at times hard to follow (it has a lot of info within it).

As of Tuesday, 12th June Microsoft have released updates to address SpectreNG. While you can install these updates Microsoft have advised their security protections will not be enabled unless you choose to do so. This is due to the lower risk of SpectreNG and also given that enabling the security enhancements of these updates can lead to a performance penalty of up to 8% (as I detailed below).

Microsoft provide step by step advice and guidance if you wish to enable these updates within this security advisory. It is likely other OS vendors will take a similar approach e.g. Red Hat may also choose to distribute these updates but not enable them so as to work around the performance penalty.

For more information on the semi-related Intel Lazy Floating point vulnerability, please see my separate post.

Thank you.

Original Post
On Monday more details of these vulnerabilities were made available by affected vendors among them Red Hat, Google, Intel, IBM and Microsoft. There are two new vulnerabilities named:

Rogue System Register Read (Spectre Variant 3a) (CVE-2018-3640)

Speculative Store Bypass (SSB) (Spectre Variant 4) (CVE-2018-3639)

Why should these vulnerabilities be considered important?

Rogue System Register Read cannot be leveraged by an external attacker; they must instead log onto a vulnerable system and carry out further steps to exploit it. Once exploited the attacker may be able to obtain sensitive information by reading system parameters via side-channel analysis.

For Windows; successful exploitation of this vulnerability will bypass Kernel Address Space Layout Randomization (KASLR) protections. I have talked about ASLR (defined) before but provides this link more detail on kernel ASLR.

Google Project Zero’s Jann Horn and Microsoft’s Ken Johnson first reported Speculative Store Bypass. It can possibly be used by attacker externally (from the internet). I use the term “possibly” since the mitigations added to web browsers following Spectre variant 2 earlier this year will make it more difficult for an attacker to do so. Indeed, Intel rates the risk as “moderate.” This is a more serious vulnerability which may allow an attacker access to read privileged memory areas. An example would be a script running in one browser tab being able to read data from another browser tab.

Red Hat have made available a video more clearly explaining the Speculative Store Bypass (SSB) vulnerability.

How can I protect myself from these vulnerabilities?
At this time microcode updates are being developed by Red Hat, AMD, ARM, Intel, IBM and Microsoft. The affected products from many popular vendors are available from the following links. These vulnerabilities will not be addressed via software fixes but hardware fixes instead.

It is recommended to follow the best practice advice for these vulnerabilities as per the US-CERT namely:

1. Please refer to and monitor the links below for the updates from affected vendors.
2. Test these updates before deploying them widely
3. Ensure the performance impact (anticipated to be between 2 – 8%) is acceptable for the systems you manage/use.

These updates will ship with the mitigations disabled and if appropriate/acceptable for an affected system; the protection (along with its performance impact) can be enabled.

These updates are scheduled to be made available before the end of May. Cloud vendors (e.g. Amazon AWS, Microsoft Azure etc.) will also update their systems once the performance impact is determined and if deemed acceptable.

Thank you.






Microsoft (full impact yet to be determined):


Red Hat:




VMware ESXI, Fusion/Fusion Pro, Workstation/Workstation Pro and vCenter Server: