--- id: CP-087 slug: side-channel-attacks-spectre-meltdown lang: en title: Side-channel attacks description: "Spectre and Meltdown: how malicious code reads secrets through the processor, with nothing shown on screen, and how to protect yourself." canonical_url: https://startbrain.io/cyberpedia/en/articles/side-channel-attacks-spectre-meltdown/ markdown_url: https://startbrain.io/cyberpedia/en/articles/side-channel-attacks-spectre-meltdown.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Side-channel attacks", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/side-channel-attacks-spectre-meltdown/ (CC BY 4.0) wing: 1 theme: secure_devices reflex: cr-054 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/side-channel-attacks-spectre-meltdown/ fr: https://startbrain.io/cyberpedia/fr/articles/attaques-canal-auxiliaire-spectre-meltdown/ de: https://startbrain.io/cyberpedia/de/articles/seitenkanalangriffe-spectre-meltdown/ es: https://startbrain.io/cyberpedia/es/articles/ataques-canal-auxiliar-spectre-meltdown/ sources: - "n": 1 title: Meltdown and Spectre Side-Channel Vulnerability Guidance publisher: CISA url: https://www.cisa.gov/news-events/alerts/2018/01/04/meltdown-and-spectre-side-channel-vulnerability-guidance published: "2018-01-04" accessed: "2026-11-03" - "n": 2 title: Multiples vulnérabilités de fuite d'informations dans des processeurs publisher: CERT-FR (ANSSI) url: https://cert.cyber.gouv.fr/alerte/CERTFR-2018-ALE-001/ published: "2018-01-04" accessed: "2026-11-03" - "n": 3 title: "Spectre Attacks: Exploiting Speculative Execution" publisher: arXiv url: https://arxiv.org/abs/1801.01203 published: "2018-01-03" accessed: "2026-11-03" - "n": 4 title: Multiples vulnérabilités dans les produits VMware publisher: CERT-FR (ANSSI) url: https://cert.cyber.gouv.fr/avis/CERTFR-2018-AVI-006/ published: "2018-01-04" accessed: "2026-11-03" - "n": 5 title: Vulnerability management guidance publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/vulnerability-management/guidance accessed: "2026-11-03" --- # Side-channel attacks A side-channel attack observes a side effect of computation, for example the time a memory read takes to complete, and uses it to infer information the attacker is not allowed to read. Spectre and Meltdown, made public on 4 January 2018 [2], are two examples. They affect the processor itself. Spectre concerns almost all devices [1], while Meltdown does not affect AMD [2]. Nothing appears on the employee's screen: the employee's role is to keep devices up to date and to install patches only from official sources [2]. ## In 30 seconds - Where it happens: on a computer, phone or server whose processor is affected, as soon as foreign code runs on it (JavaScript, malicious advertising, phishing) [1]. - What the attacker wants: to read memory not meant for them, and so keystrokes, passwords or encryption keys [1]. - The reflex: install security patches as soon as possible, and only from the vendors' official sources [2]. - If it is already done: apply the following updates anyway, because some first patches were partial [2]. ## Straight answers ### Would I see anything if I were targeted? No, the sources cited here describe no sign visible on screen. A classic antivirus relies on signatures and may not detect these vulnerabilities [1]. CERT-FR did publish Yara rules to spot binaries linked to a public Meltdown demonstration library, which concerns security teams, not employees [2]. ### Do I have to click on something to be attacked? The attacker must first get code executed on the machine. CISA names malicious JavaScript, malicious advertising and phishing as ways to achieve this [1]. ### Which devices are affected? Spectre affects almost all devices: desktop and laptop computers, cloud servers and phones [1]. The researchers refer to Intel, AMD and ARM processors used in billions of devices [3]. According to CERT-FR, AMD is vulnerable to Spectre but not to Meltdown [2]. ### Is one patch enough? Not always. For Spectre, CISA states that the flaw lies in the processor architecture and not in software, that it is hard to fix, but harder to exploit [1]. The authors of the research paper estimate that solid solutions will require changing processor design [3]. ## Inside the attacker's head The attacker wants the data another program keeps in memory. On a workstation, that is the operating system's memory, which according to CISA contains keystrokes, passwords and encryption keys [1]. The starting point is code the attacker manages to get running: malicious JavaScript, malicious advertising or phishing [1]. Once this code is in place, CERT-FR explains that Meltdown makes it possible to access operating system memory from a user program [2]. CISA adds that an attacker could also elevate privileges to exploit these flaws [1]. The impact is heavier where resources are shared. CERT-FR notes that from a container (Docker, LXC), it might be possible to access the data of the physical machine hosting it [2]. ## What you see on screen Nothing in particular. The sources cited here describe no message or slowdown as a warning sign. The only visible effect is on the defense side: after patching, performance may vary depending on use, and CISA asks administrators to monitor it on critical applications [1]. A trap does exist around the subject, however, and it is visible: fake patches (see below). ## Under the hood Modern processors try to go fast. CERT-FR describes two techniques. In so-called out-of-order execution, instructions run according to the availability of computing resources rather than in a strictly sequential way [2]. In speculative execution, the processor makes assumptions about results not yet available and carries on working; if the assumption is wrong, the effects are cancelled [2]. Meltdown exploits a weakness of the first: an instruction can run without the required privilege level being properly checked. Its result is not validated afterwards, but the information can be recovered through a covert channel [2]. Spectre exploits the second. The effects of an erroneous speculative execution on the cache persist, and by measuring access times to memory areas, the state of the cache is known. The attacker infers from it the intermediate results of the erroneous execution [2]. The authors of the research paper describe this as inducing the victim to speculatively perform operations that would not normally occur and whose information leaks through a side channel [3]. Three identifiers designate the initial flaws: CVE-2017-5753 and CVE-2017-5715 for Spectre, CVE-2017-5754 for Meltdown [2]. ## Case files ### 3 and 4 January 2018: the disclosure CISA states that it learned of Meltdown and Spectre on 3 January 2018 [1]. The research paper on Spectre is filed the same day [3]. CERT-FR dates the publication of the two vulnerabilities to 4 January 2018 [2], and publishes an advisory the same day on VMware products: ESXi, Workstation and Fusion are affected as long as the patches are not installed [4]. ### A fake patch in the name of the BSI CERT-FR observes a spam campaign that takes advantage of the situation. Attackers posing as the BSI, the German equivalent of ANSSI, invite recipients to visit a copy of its website. The alert there is altered: the user is invited to install a patch that is in fact malware [2]. CERT-FR reminds readers to install patches only from the vendors' official sources [2]. ### April 2018: "Total Meltdown" According to CISA, users of 64-bit Windows 7 or 64-bit Windows Server 2008 R2 on an Intel processor, who had installed the January or February 2018 patch, needed to install the latest patch without delay. According to researcher Ulf Frisk, the earlier patches contained a flaw allowing reading and writing in kernel memory [1]. It carries the identifier CVE-2018-1038 [1]. ### May 2018: new variants On 21 May 2018, two new vulnerabilities based on similar principles, CVE-2018-3639 and CVE-2018-3640, are published [2]. ## What you do - Install system and browser updates. For Intel firmware, CERT-FR recommends increased caution, even waiting for the final version, and testing patches in controlled environments before deploying them [2]. - Install only trusted software. Download patches and firmware directly from the vendor's website [1]. - If your computer is managed by the company, let the IT department carry out the updates. The NCSC recommends a default update policy, with patches applied as early as possible and ideally automatically [5]. - Do not follow an email that asks you to install a "patch": go through official sources [2]. ## Pitfalls The first pitfall is believing that antivirus protects. CISA invites readers to check with the antivirus vendor for compatibility with the patches [1]. According to CERT-FR, Microsoft's patches depend on the antivirus installed [2]. Another pitfall: relying on a first patch. Several vendors had published only partial patches [2], and the "Total Meltdown" case shows that a patch can itself contain a flaw [1]. Finally, delays in updates of updates also cause problems: the NCSC specifies that deciding not to update is a risk decision at management level [5]. ## Sources 1. CISA, "Meltdown and Spectre Side-Channel Vulnerability Guidance", 4 January 2018. https://www.cisa.gov/news-events/alerts/2018/01/04/meltdown-and-spectre-side-channel-vulnerability-guidance (accessed 3 November 2026) 2. CERT-FR (ANSSI), "Multiples vulnérabilités de fuite d'informations dans des processeurs", 4 January 2018. https://cert.cyber.gouv.fr/alerte/CERTFR-2018-ALE-001/ (accessed 3 November 2026) 3. arXiv, "Spectre Attacks: Exploiting Speculative Execution", 3 January 2018. https://arxiv.org/abs/1801.01203 (accessed 3 November 2026) 4. CERT-FR (ANSSI), "Multiples vulnérabilités dans les produits VMware", 4 January 2018. https://cert.cyber.gouv.fr/avis/CERTFR-2018-AVI-006/ (accessed 3 November 2026) 5. NCSC (UK), "Vulnerability management guidance". https://www.ncsc.gov.uk/collection/vulnerability-management/guidance (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/side-channel-attacks-spectre-meltdown/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.