MacRumors

macrumors bot
Original poster
Apr 12, 2001
52,997
14,744



Apple today confirmed that it has addressed the recent "Meltdown" vulnerability in previously released iOS 11.2, macOS 10.13.2, and tvOS 11.2 updates, with additional fixes coming to Safari in the near future to defend against the "Spectre" vulnerability.

12-inch-macbook-macbook-pro-duo.jpg

Apple has also confirmed that the two vulnerabilities affect all Mac and iOS devices. The company's full statement, available through a new support document covering Meltdown and Spectre, is below:
Security researchers have recently uncovered security issues known by two names, Meltdown and Spectre. These issues apply to all modern processors and affect nearly all computing devices and operating systems.

All Mac systems and iOS devices are affected, but there are no known exploits impacting customers at this time. Since exploiting many of these issues requires a malicious app to be loaded on your Mac or iOS device, we recommend downloading software only from trusted sources such as the App Store.

Apple has already released mitigations in iOS 11.2, macOS 10.13.2, and tvOS 11.2 to help defend against Meltdown. Apple Watch is not affected by Meltdown. In the coming days we plan to release mitigations in Safari to help defend against Spectre. We continue to develop and test further mitigations for these issues and will release them in upcoming updates of iOS, macOS, tvOS, and watchOS.
Apple's statement does not make it clear if these vulnerabilities have been addressed in older versions of iOS and Mac, but for Macs, there were security updates for older versions of macOS released alongside macOS 10.13.2, so it's possible fixes are already available for Sierra and El Capitan.

News of the Spectre and Meltdown vulnerabilities first came to light this week, but Intel and major operating system vendors like Apple, Linux, and Microsoft have known about the issue for several months and worked to prepare a fix before the security flaws were publicly shared.

Spectre and Meltdown are serious vulnerabilities that take advantage of the speculative execution mechanism of a CPU. As these use hardware-based flaws, operating system manufacturers are required to implement software workarounds. These software workarounds can impact processor performance, but Intel has insisted most users will not see serious slowdowns. Apple also says that no measurable impact has been detected in macOS and iOS.
Apple released mitigations for Meltdown in iOS 11.2, macOS 10.13.2, and tvOS 11.2. watchOS did not require mitigation. Our testing with public benchmarks has shown that the changes in the December 2017 updates resulted in no measurable reduction in the performance of macOS and iOS as measured by the GeekBench 4 benchmark, or in common Web browsing benchmarks such as Speedometer, JetStream, and ARES-6.
The Meltdown vulnerability allows a malicious program to read kernel memory, accessing data like passwords, emails, documents, photos, and more. Meltdown can be exploited to read the entire physical memory of a target machine. The vulnerability is particularly problematic for cloud-based services.

Spectre, which covers two exploitation techniques, breaks the isolation between different applications. Apple says that while the Spectre vulnerability is difficult to exploit, it can be done using JavaScript in a web browser. Apple plans to release Safari updates for macOS and iOS to prevent Spectre-based exploits.

As with the Meltdown vulnerability, Apple says the upcoming Safari mitigations will have "no measurable impact" on Speedometer and ARES-6 tests, and an impact of less than 2.5% on the JetStream benchmark.

Apple says it will continue to test further mitigations for Spectre and will release them in future versions of iOS, macOS, tvOS, and watchOS.

Update: Apple has updated its Meltdown and Spectre support document to clarify that the Apple Watch is not affected by either vulnerability. Previously, Apple had only confirmed that the Apple Watch was unaffected by Meltdown.

Update 2: Apple has confirmed that fixes have also been released for macOS Sierra and OS X El Capitan in an updated security support document.

Update 3: The support document that confirmed the fixes for Sierra and El Capitan has been updated again to remove references to these two operating systems, so it remains unclear whether or not Meltdown fixes have been released for these two older operating systems.


Article Link: Apple Confirms 'Meltdown' and 'Spectre' Vulnerabilities Impact All Macs and iOS Devices, Some Fixes Already Released [Updated]
 

anzio

macrumors 6502
Dec 5, 2010
423
581
Innisfil, Ontario, Canada
Great to hear that there was some proactive action taken quickly against these vulnerabilities. And glad to see the flaws took the proper disclosure path rather than someone tweeting how to take advantage of the vulnerability for his/her 15 minutes of fame. ;)
 
  • Like
Reactions: RandomDSdevel
Comment

OldSchoolMacGuy

Suspended
Jul 10, 2008
4,197
9,049
Great to hear that there was some proactive action taken quickly against these vulnerabilities. And glad to see the flaws took the proper disclosure path rather than someone tweeting how to take advantage of the vulnerability for his/her 15 minutes of fame. ;)

Daniel Gruss, a information security researcher and post-doctoral fellow at Austria's Graz Technical University was the one that discovered Meltdown last year. Though now Google claims they too discovered it after that time. Seems like one of those, "Oh... uh.... yeah... we totally already knew about that but just didn't say anything. We're totally in the know.", on Google's part.
 
Comment

bradl

macrumors 601
Jun 16, 2008
4,075
14,854
The question looming here is, will those MacOS patches be backported to Sierra down to Mavericks, or even if supported, Mountain Lion? We already know that previous versions of iOS and tvOS are not going to have this patch, so they're stuck.. but what of MacOS?

BL.
 
Comment

SecuritySteve

macrumors demi-god
Jul 6, 2017
907
1,017
California
The question looming here is, will those MacOS patches be backported to Sierra down to Mavericks, or even if supported, Mountain Lion? We already know that previous versions of iOS and tvOS are not going to have this patch, so they're stuck.. but what of MacOS?

BL.
Most likely the fixes will be back ported to Sierra and El Capitan alongside 10.13.3. It's not official policy, but Apple only releases security updates for the latest, and previous two OS's. Anything behind El Capitan is EOL by most software security scanners.
 
Comment

tim1000

macrumors regular
Sep 16, 2014
179
31



Apple today confirmed that it has addressed the recent "Meltdown" vulnerability in previously released iOS 11.2, macOS 10.13.2, and tvOS 11.2 updates, with additional fixes coming to Safari in the near future to defend against the "Spectre" vulnerability.

12-inch-macbook-macbook-pro-duo.jpg

Apple has also confirmed that the two vulnerabilities affect all Mac and iOS devices. The company's full statement, available through a new support document covering Meltdown and Spectre, is below:Apple's statement does not make it clear if these vulnerabilities have been addressed in older versions of iOS and Mac, but for Macs, there were security updates for older versions of macOS released alongside macOS 10.13.2, so it's possible fixes are already available for Sierra and Yosemite.

News of the Spectre and Meltdown vulnerabilities first came to light this week, but Intel and major operating system vendors like Apple, Linux, and Microsoft have known about the issue for several months and worked to prepare a fix before the security flaws were publicly shared.

Spectre and Meltdown are serious vulnerabilities that take advantage of the speculative execution mechanism of a CPU. As these use hardware-based flaws, operating system manufacturers are required to implement software workarounds. These software workarounds can impact processor performance, but Intel has insisted every day users will not see serious slowdowns. Apple also says that no measurable impact has been detected in macOS and iOS.The Meltdown vulnerability allows a malicious program to read kernel memory, accessing data like passwords, emails, documents, photos, and more. Meltdown can be exploited to read the entire physical memory of a target machine. The vulnerability is particularly problematic for cloud-based services.

Spectre, which covers two exploitation techniques, breaks the isolation between different applications. Apple says that while the Spectre vulnerability is difficult to exploit, it can be done using JavaScript in a web browser. Apple plans to release Safari updates for macOS and iOS to prevent Spectre-based exploits.

As with the Meltdown vulnerability, Apple says the upcoming Safari mitigations will have "no measurable impact" on Speedometer and ARES-6 tests, and an impat of less than 2.5% on the JetStream benchmark.

Apple says it will continue to test further mitigations for Spectre and will release them in future versions of iOS, macOS, tvOS, and watchOS.

Article Link: Apple Confirms 'Meltdown' and 'Spectre' Vulnerabilities Impact All Macs and iOS Devices, Some Fixes Already Released

what is that wallpaper on those Macbooks?
 
Comment
Jul 4, 2015
4,488
2,549
Paris
Daniel Gruss, a information security researcher and post-doctoral fellow at Austria's Graz Technical University was the one that discovered Meltdown last year. Though now Google claims they too discovered it after that time. Seems like one of those, "Oh... uh.... yeah... we totally already knew about that but just didn't say anything. We're totally in the know.", on Google's part.

This guy appeared worried about Spectre-like attacks in 2015

https://www.linuxquestions.org/ques...pted-too-without-special-hardware-4175538050/
 
  • Like
Reactions: RandomDSdevel
Comment

skinned66

macrumors 65816
Feb 11, 2011
1,366
1,224
Ottawa, Canada
Most likely the fixes will be back ported to Sierra and El Capitan alongside 10.13.3. It's not official policy, but Apple only releases security updates for the latest, and previous two OS's. Anything behind El Capitan is EOL by most software security scanners.
IIRC correctly they were pretty good with supporting the Heartbleed vulnerability in this regard, I think they'll do more of the same
 
  • Like
Reactions: RandomDSdevel
Comment

Act3

macrumors 68020
Sep 26, 2014
2,198
2,546
USA
  • Like
Reactions: RandomDSdevel
Comment

dogslobber

macrumors 601
Oct 19, 2014
4,377
7,370
Apple Campus, Cupertino CA
That was quick. And yet there were still many crying "Why won't Apple be more open and talk about this!!!!"
Internally, certain people working on the fix will have known for at least a month or longer. These issues are so secretive that even your manager doesn't know what you're doing. Security bugs are very hush-hush until the cat is out of the bag.
 
Comment

SecuritySteve

macrumors demi-god
Jul 6, 2017
907
1,017
California
IIRC correctly they were pretty good with supporting the Heartbleed vulnerability in this regard, I think they'll do more of the same
Oh yeah. I think that goes without saying. Most of the public is not aware but far more severe vulnerabilities than this get patched every time there's a security update for macOS / Windows / iOS / Linux / Whatever. They just don't get as much publicity. That lack of publicity is a good thing, as misunderstanding the nature of zero-day vulnerabilities could lead to panic.

Edit: This is why my signature includes "Just update your software. Seriously" The average person has no idea how many vulnerabilities are closed just from updating your software.
 
Comment

crazy dave

macrumors 6502
Sep 9, 2010
387
214
"Our testing with public benchmarks has shown that the changes in the December 2017 updates resulted in no measurable reduction in the performance of macOS and iOS as measured by the GeekBench 4 benchmark, or in common Web browsing benchmarks such as Speedometer, JetStream, and ARES-6."

Most likely the fixes will be back ported to Sierra and El Capitan alongside 10.13.3. It's not official policy, but Apple only releases security updates for the latest, and previous two OS's. Anything behind El Capitan is EOL by most software security scanners.

In the December 2017 updates for all 3 supported operating systems, it seems like Meltdown has already been fixed for Sierra and El Cap too, but the CVE numbers are different which is why people (including me) are still confused because the descriptions of the fixed errors in Sierra and El Cap read like Meltdown. So it's a little unclear what's going on.
 
Comment

cube

Suspended
May 10, 2004
17,011
4,970
Internally, certain people working on the fix will have known for at least a month or longer. These issues are so secretive that even your manager doesn't know what you're doing. Security bugs are very hush-hush until the cat is out of the bag.
Google told Intel, ARM, and AMD last June about it.
 
  • Like
Reactions: RandomDSdevel
Comment

SecuritySteve

macrumors demi-god
Jul 6, 2017
907
1,017
California
"Our testing with public benchmarks has shown that the changes in the December 2017 updates resulted in no measurable reduction in the performance of macOS and iOS as measured by the GeekBench 4 benchmark, or in common Web browsing benchmarks such as Speedometer, JetStream, and ARES-6."



In the December 2017 update it seems like they already have been fixed, but the CVE numbers are different which is why people (including me) are still confused because the descriptions of the fixed errors in Sierra and El Cap read like Meltdown. So it's a little unclear what's going on.
The 'fix' was not a security fix for the vulnerabilities. Those CVEs are identifiers for separate vulnerabilities that were fixed by the security update. I'm not convinced that the security update was back ported to the kernel in Sierra / El Capitan since changes that are feature changes (which the fix for Meltdown would've been considered via the double buffer kernel change) are not included in security changes unless they are explicitly stated to fix a security issue. I would bet that the mitigations in 10.13.2 are not present in Sierra / El Capitan presently.
 
Comment

urmaster

macrumors member
Mar 23, 2016
32
33
I thought meltdown only affects Intel processors. Why would iOS have to patch for this?
My thoughts exactly, I thought that spectre was demonstrated on ARM. All these companies and journalists are contradicting themselves. I imagine there is still a lot of ongoing work and not everything has been made public and clearly not enough coordination amongst the researchers and companies. Seems like everyone is scrambling to get in front of the press.
 
Comment
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.