This week, the world learned of widespread and serious vulnerabilities in most central processing units (CPU). CPUs manage the instructions received from the hardware and software running on a computer. The vulnerabilities, named Meltdown and Spectre, affect virtually every computer existing today, in particular those with Intel, Advanced Micro Devices, Inc. (AMD), Nvidia and Arm Holdings (ARM) processors.
Spectre and Meltdown essentially permit unauthorized access to an operating system’s secure and secret kernel memory, which often contains highly sensitive data, such as passwords, secret keys and other credentials as well as personal photos and emails. Generally, any personal or desktop computer, laptop, cloud system, mobile device, tablet or other computing device that uses these processors is vulnerable. In addition, Intel processors are used in a wide array of products, from personal computers to medical equipment. For a detailed technical description of how the vulnerabilities can be exploited, see https://googleprojectzero.blogspot.gr/2018/01/reading-privileged-memory-with-side.html
Initially, the Software Engineering Institute (SEI), a U.S.-government funded body operated by Carnegie Mellon University for the U.S. Department of Defense researching cybersecurity problems recommended replacing the vulnerable processor hardware in order to remove the threat. However, SEI subsequently amended its advice to say that software solutions should be pursued and quickly downloaded to mitigate against the vulnerabilities. Software solutions, patches and workarounds may not resolve the vulnerability and may actually affect system performance, but at this time they are the only known feasible measure to mitigate these vulnerabilities.
A bit of good news is that The European Union Agency for Network and Information Security (ENISA), which advices on cybersecurity matters for the EU reports that at this time, there are no known documented exploitations of these vulnerabilities. See https://www.enisa.europa.eu/publications/info-notes/meltdown-and-spectre-critical-processor-vulnerabilities