Meltdown

securityprogramming

A 2018 attack letting user programs read protected kernel memory via speculative execution.

Meltdown broke the isolation between user space and the kernel on affected CPUs, allowing arbitrary kernel memory to be read. The main mitigation, kernel page-table isolation, carried a measurable performance cost.

Meltdown broke the boundary between user programs and kernel memory on affected processors, allowing an ordinary program to read memory it had no permission to see. It was disclosed alongside Spectre and is frequently confused with it, though it is narrower and, importantly, fixable.

The mechanism is that a processor could speculatively read privileged memory and act on the value before the permission check completed, leaving cache traces that revealed the contents. Unlike Spectre, this was closer to an implementation flaw than an inherent property of speculation, which is why the mitigation could be architectural.

That mitigation was kernel page table isolation, which separates kernel and user address spaces so the privileged memory is simply not mapped when user code runs. It works and it costs, because every system call now requires switching address spaces, and workloads that make many syscalls saw substantial slowdowns. Meltdown is therefore a clean case study in security costing performance in a way that is measurable, unavoidable and paid by everyone, which is a more honest description of most security engineering than the usual framing.

Also known as: Meltdown, CVE-2017-5754

← All glossary entries