Intel Says New Software Updates Make Computers 'Immune' to Meltdown and Spectre Vulnerabilities

intelIntel today announced that the firmware updates and software patches that are being released for its CPUs render Intel-based computer systems "immune" to both the Spectre and Meltdown exploits that were widely publicized this week.

Intel has developed and is rapidly issuing updates for all types of Intel-based computer systems -- including personal computers and servers -- that render those systems immune from both exploits (referred to as "Spectre" and "Meltdown") reported by Google Project Zero. Intel and its partners have made significant progress in deploying updates as both software patches and firmware updates.

Intel says updates have been issued for the majority of Intel processor products introduced within the past five years, and by the end of next week, more than 90 percent of processor products from the last five years will be patched.

For Mac users, Apple has already addressed some of the vulnerabilities in the macOS High Sierra 10.13.2 update, and further updates will come in macOS High Sierra 10.13.3. To make sure you're protected as a Mac user, install all of the latest operating system updates and firmware patches. As always, it's also worth avoiding suspicious programs, websites, and links.

Intel today also reiterated that the updates that are being released for Mac, PC, and Linux machines should not significantly impact day to day usage and should, for the most part, be unnoticeable. That seems to be true of the macOS High Sierra 10.13.2 update, as there have been no reports of slowdowns from Mac users.

Intel continues to believe that the performance impact of these updates is highly workload-dependent and, for the average computer user, should not be significant and will be mitigated over time. While on some discrete workloads the performance impact from the software updates may initially be higher, additional post-deployment identification, testing and improvement of the software updates should mitigate that impact.

While hints of an Intel CPU design flaw and security vulnerability surfaced on Tuesday, it wasn't until Wednesday that full details were shared on the Meltdown and Spectre exploits, which take advantage of the speculative execution mechanism of a CPU.

Meltdown impacts Intel CPUs, allowing a malicious program to access data from the memory of running apps, providing passwords, emails, documents, photos, and more. Meltdown can be exploited to read the entire physical memory of a target machine, and it can be done through something as simple as a website. The vulnerability is particularly problematic for cloud-based services.

Spectre, which breaks the isolation between different applications, is a wider hardware-based problem impacting all modern Intel, ARM, and AMD processors. Spectre is harder to exploit than Meltdown, but it is also harder to mitigate.

While patches are going out that appear to prevent the current known Meltdown and Spectre exploits, these speculative execution vulnerabilities will continue to be a problem for years to come, according to security researchers. Similar vulnerabilities will surface, and while performance impacts from software-based workarounds are minor, they're still present.

Paul Kocher, one of the security researchers who helped discover the flaws, told The New York Times that this will be a "festering problem over hardware life cycles." "It's not going to change tomorrow or the day after," he said. "It's going to take awhile."

Top Rated Comments

unashamedgeek Avatar
64 months ago
Getting blown into a much bigger deal than it is.
I think that is going to depend on your definition of a "big deal". I know this is going to be a big deal in my world of pen testing for some time to come as exploits get released. Being able to jump from ring 3 to ring 0 is the main goal once gaining a foothold on a system. Additionally, Mozilla has stated they have proven that a browser can be used to exploit these so if XSS can be used to pull memory contents, I'm going to have some fun engagements coming up.

EDIT: I forgot to even discuss the potential issues with host and guest systems. Popping a guest OS and being able to access memory on the host, now we're really talking full compromise.
Score: 11 Votes (Like | Disagree)
longofest Avatar
64 months ago
Intel today also reiterated that the updates that are being released for Mac, PC, and Linux machines should not significantly impact day to day usage and should, for the most part, be unnoticeable.
However, if you are running any kind of significant workload that access the kernel frequently, such as frequent I/O requests used in database applications, then the impact is actually quite severe. People have seen their cloud services go to crap as the providers apply the patches.

I get that most day to day users may not care about this on their desktops, but step back and think about this a minute. You have a potentially 20-30% CPU performance hit on the cloud. That means that in order to achieve the same performance this week as they did last week, cloud computing providers will have to bump their capacity by potentially 20-30%. Along with that comes more power demands which renewable sources may or may not be able to meet...

Some of you are saying "this is getting blown out of proportions." I say the impacts of this are just starting to be felt.
Score: 8 Votes (Like | Disagree)
jclo Avatar
64 months ago
I pretty sure that so far they have only worked to patch Meltdown. My system is up to date and the Spectre PoC released by Google still works on my MacBook Pro.
Another instance where I really wish Apple would provide us with some clarification and additional information.
Score: 5 Votes (Like | Disagree)
EdwardC Avatar
64 months ago
But then I would have to update to High Sierra..... What to do.......
https://support.apple.com/en-gb/HT208331

Possibly not.
Score: 4 Votes (Like | Disagree)
unashamedgeek Avatar
64 months ago
For Mac users, Apple has already addressed the vulnerabilities ('https://www.macrumors.com/2018/01/03/intel-design-flaw-fixed-macos-10-13-2/') in the macOS High Sierra 10.13.2 update, and further updates will come in macOS High Sierra 10.13.3.
I pretty sure that so far they have only worked to patch Meltdown. My system is up to date and the Spectre PoC released by Google still works on my MacBook Pro.
Score: 2 Votes (Like | Disagree)
coolfactor Avatar
64 months ago
But then I would have to update to High Sierra..... What to do.......
Is there something stopping you from updating to High Sierra? It works great.
[doublepost=1515110243][/doublepost]
Does this affect a Mac running Mavericks?
Yes.
[doublepost=1515110410][/doublepost]
I’m really curious to see some benchmarks of before and after. Gladly with this amount of people with too much free time on websites such as this I can be confident there will be plenty soon.
Benchmarks will be pretty non-informative, as benchmarking software tends to max out the CPU and therefore may over-exaggerate the effects that one would experience. It's been reported that the fixes are "barely noticeable" in day-to-day computing. Only very specific applications may run into a performance reduction, and likely not as noticeable as media wants us to believe.
[doublepost=1515110506][/doublepost]
What about people that don’t want to upgrade to 10.13? My 2013 MBP is still running El Cap. We’re these released in security updates??
Do yourself a favour. Update to 10.13 AND ensure you are using an SSL internally, and your four-year old computer will feel newer than new. Performance will be incredible.

Is there something keeping you on El Cap other than fear?
Score: 2 Votes (Like | Disagree)

Popular Stories

General Black Friday Deals 2022 Green

All the Apple Black Friday Deals You Can Still Get

Friday November 25, 2022 4:40 am PST by
Although Black Friday is now technically over, many Apple products are still seeing major discounts through the weekend as we head into Cyber Monday. In this article, you'll find every Apple device with a notable Black Friday sale that's still available. We'll be updating as prices change and new deals arrive, so be sure to keep an eye out if you don't see the sale you're looking for yet. Note:...
iphone 14 pro hands snowflakes 1

Best Cyber Monday iPhone Deals Available Today

Wednesday November 23, 2022 1:55 pm PST by
Cellular carriers have always offered big savings on the newest iPhone models during the holidays, and Cyber Monday is no different. We're tracking notable offers on the iPhone 14 and iPhone 14 Pro devices from AT&T, Verizon, and T-Mobile. For even more savings, keep an eye on older models like the iPhone 13. Note: MacRumors is an affiliate partner with some of these vendors. When you click a...
maxresdefault

Nothing Phone 1 Displays AirPods Battery Level After Latest OS Update

Friday November 25, 2022 3:33 am PST by
Nothing Phone 1 users today began receiving the Nothing OS 1.1.7 update, which adds support for displaying the battery percentage of connected AirPods, amongst other improvements and bug fixes. If you own a Nothing Phone 1, you can check for the OTA update by going to Settings -> System -> System updates. Bear in mind that as support for displaying AirPods battery level is still an...
ipad holiday bulbs

Best Cyber Monday iPad Deals Available Today

Thursday November 24, 2022 12:25 pm PST by
Cyber Monday deals have been in full swing since Black Friday deals ended, and we're seeing solid discounts on Apple devices. We're highlighting the best sales for all of Apple's product lines, and in this article you'll find the best Cyber Monday sales on iPad, iPad Pro, iPad Air, and iPad mini. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make ...
airpods pro 2

Apple Engineer Addresses Lack of Lossless Support on New AirPods Pro

Friday November 25, 2022 2:58 am PST by
An Apple engineer has addressed the lack of lossless audio support in the second-generation AirPods Pro in a new interview. Current Bluetooth technology in the AirPods lineup means that Apple's audio products do not support Apple Music Lossless audio. Apple has previously hinted that it may develop its own codec and connectivity standard that builds on AirPlay and supports higher quality...
Cyber Monday Deals Feature 2022

Best Cyber Monday Apple Deals Still Available for AirPods, Apple TV, iPad, and More

Monday November 28, 2022 5:24 am PST by
The Black Friday and Cyber Monday holiday shopping rush is drawing to a close, but there are still some good deals to be had out there. For Apple products, many of the deals you've seen since last week are still available, though some have expired. So for anyone who missed out on Black Friday deals, there's still an opportunity to get some of the year's best prices on many Apple devices. Note: ...
Apple Watch Ultra Oceanic Plus App

Apple Announces Oceanic+ App Now Available for Apple Watch Ultra

Monday November 28, 2022 6:11 am PST by
Apple today announced that the Oceanic+ app is available for the Apple Watch Ultra starting today. Designed by Huish Outdoors in collaboration with Apple, the app serves as a dive computer for recreational scuba diving at depths up to 40 meters/130 feet. Apple already offers a basic Depth app on the Apple Watch Ultra for viewing your current depth, maximum depth reached, water temperature,...
Three Biggest iPhone SE 4 Questions Feature

Three Biggest Questions About the iPhone SE 4

Saturday November 26, 2022 12:00 am PST by
While we already have some clear indications about what to expect from the fourth-generation iPhone SE, there are three major questions looming over the device at the current time. Chinese site MyDrivers and and leaker Jon Prosser believe that the iPhone SE is set to move to an iPhone XR-like design in its next incarnation, which would involve eliminating the Home button and adding a "notch" ...