Information on Meltdown and Spectre
Google Project Zero has discovered a security hole in the processor design that Intel has been using for the past 20 years. AMD and ARM processors are also affected.
The probability of this vulnerability being exploited is relatively small, but it basically affects everything that has been established in IT. The solution seems to be patching OS, virtualisation layers (Hypervisor), but other measures will probably also be required, including upgrading firmware and configuration changes. These patches have been shown to reduce performance by between 5–30%. The effect can vary between different kinds of workload, and will be greatest for old equipment with older CPU models. At the moment there have been no proven attacks via malware or other malicious code that uses Meltdown or Spectre.
What is affected?
The security hole affects all PCs, servers and cloud platforms from all producers and all operating systems.
What is Softronic doing?
We are working to secure our customers’ environments and will (in consultation with our customers) patch firmware, as well as virtualisation layers and operating systems. Update: There are currently no patches available from the hardware suppliers. Softronic is keeping itself updated on the most recent information.
What is Microsoft doing?
Microsoft is in the process of patching all of Azure, and we have been told that all virtual servers should be restarted. If you do not do this yourself, Microsoft will restart your servers. https://azure.microsoft.com/en-us/blog/securing-azure-customers-from-cpu-vulnerability/
What is Amazon doing?
Amazon says that all their environments are protected. However, they recommend their customers to patch their guest operating systems themselves. https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/ For more information: https://www.cert.se/2018/01/kernel-side-channel-attack
