Two new and related security vulnerabilities called “Spectre” and “Meltdown” are significant because they affect computing platforms with Intel, AMD, or ARM central processing units (CPU’s). This includes Mac, Windows, Linux, Android and other platforms. These vulnerabilities take advantage of the ability to extract information from instructions that have been executed on a CPU using the CPU cache as a side-channel.
The impact if exploited is that an attack would allow reading of memory and data leaks that can result in privilege escalation, disclosure of sensitive information, or weaken security protections. From US Government:
The solution is to apply patches from appropriate OS vendors such as Microsoft, Apple, and Google. Unfortunately, these patches may degrade system performance by as much as 30% for some processes. In addition, organizations with cloud infrastructure should work with their Cloud Service Provider (CSP) to patch systems and mitigate service and performance impacts resulting from host OS patching and reboots.
More information at the links below:
Don Rudolph | CISO/Sr. Consultant