What are the CPU Vulnerabilities (Meltdown/Spectre)?
CPU vulnerabilities like Meltdown and Spectre, told as a story about the trace left behind by a worker who guesses ahead.
A worker doing every job strictly in order is far too slow.Meanwhile, guests end up waiting and waiting.
The worker guesses the next job and quietly prepares it.The worker is the CPU. A right guess is much faster than working in order. But...
Even a wrong guess leaves a trace behind, in the shelf.An attacker measures that trace to learn the secret in the vault — that attack is Meltdown and Spectre.
Meltdown and Spectre differ in what gets peeked at.Meltdown peeks into a room it should never enter at all (the kernel); Spectre tricks a program into guessing its way into another room.
Patching can slow the CPU down, and the flaws that come from guessing are hard to remove fully.A patch reduces the trace but can't remove the flaw entirely — guessing ahead is the very reason the CPU is fast.
The CPU vulnerabilities Meltdown and Spectre = flaws where a CPU that guesses ahead leaves a trace in its cache even on a wrong guess — a trace an attacker can read back to leak information.
Meltdown and Spectre (disclosed in 2018) are hardware vulnerabilities that abuse speculative execution, an optimization in modern CPUs. A CPU runs upcoming instructions ahead of time (Spectre abuses branch prediction; Meltdown abuses out-of-order execution that reads memory before the permission check lands). If the prediction was wrong or permission is missing, the results are discarded, but the memory it touched along the way leaves a trace in the cache. An attacker can measure tiny differences in cache-access timing — a side-channel attack — to indirectly read kernel memory (Meltdown) or another process's memory (Spectre). Microcode and OS patches mitigate the issue but can cost performance. Later CPUs block Meltdown in hardware, but the Spectre family stems from a fundamental design trade-off and is hard to eliminate completely.
When grown-ups say it
- Speculative execution
- Doing the work before being asked. The core trick that makes a CPU fast. A wrong guess only discards the result.
- Cache timing
- The trace left on the shelf (the cache). Memory that was peeked at sits in the cache, so reading it again is faster — that speed gap gives away the trace.
- Side-channel attack
- Reading the trace by measuring it. Not a direct theft — it infers the secret from an indirect signal like timing.
- Meltdown
- Peeking all the way into the vault (kernel). Speculatively reaches into memory that should be completely off-limits.
- Spectre
- Tricking the worker into peeking at another guest's room. Tricks the program itself into guessing wrong. Harder to fully block than Meltdown.
- Microcode/OS patch
- A patch boarding up the shelf. Fixed jointly by the chipmaker and the OS. → the board the carpenter sent
- Performance cost
- A CPU that guesses less runs slower. A straight trade-off between safety and speed.
- Hardware vulnerability
- A gap in the CPU's own design. A gap that a software patch alone can't fully close.