Abstract

When they were publicly disclosed Spectre and Meltdown were described as an “absolute disaster” and prompted statements and blog posts from numerous tech companies describing the effects on their customers. The reason: Spectre and Meltdown both broke the fundamental security assumption of isolation and were both independent of the Operating System on which they were being run. Not only were the vulnerabilities not the result of a bug in software, but they could be exploited by Javascript code running in a browser and affected around 80% of modern desktops, including all but two variants of Intel processors produced after 1995¹.

This talk will describe the background and details of one variant of Spectre, it will then describe Meltdown and will finish with a look at the interesting implementation details required for a working attack.

[1] https://meltdownattack.com/