Spectre & Meltdown (2018)

To be fast, modern CPUs guess what code will run next and run it early: speculative execution. If a guess is wrong, the results are thrown away, but traces stay in the CPU cache, and a careful program can time memory accesses to read them back. Meltdown (CVE-2017-5754) let an ordinary program read kernel memory, mainly on Intel chips. Spectre (CVE-2017-5753 and CVE-2017-5715) tricks other programs, even a browser's JavaScript engine, into speculatively leaking their own secrets.

Jann Horn of Google Project Zero, researchers at Graz University of Technology, Cyberus Technology and others found them independently. Disclosure came on 3 January 2018, days early, after reporters noticed unusual Linux kernel patches. Meltdown was fixed in software with kernel page-table isolation (KPTI), which slowed some database and I/O-heavy workloads noticeably. Spectre is a family rather than one bug: it needed compiler changes, microcode updates and browser changes, and new variants kept appearing.

No confirmed attacks have used them, but the risk is real. In 2021 a researcher found working Spectre exploits for Windows and Linux uploaded to VirusTotal, apparently modules for a commercial penetration-testing tool; the Linux one could dump the system's password file. The lesson matters most for cloud and shared hosting: when strangers share your hardware, the hardware is part of your attack surface.