Is Your Android Safe Against Spectre and Meltdown Flaws?

Software and hardware security threats are becoming our greatest fear. We read about new software security holes about once a week and we evidence software vendors rushing to provide patches for them. Yesterday, two new security threats came into light, Meltdown and Spectre. These threats are generating a lot of heat among security-concerned computer enthusiasts for one simple reason: They are not the typical software bugs we are used to. Instead, they affect the hardware and most specifically the microprocessor.

Solving these issues will not be as easy as finding the affected line in source code and modifying it. They originate deep inside the CPU architecture and affect processors 20+ years old. Because they are hardware-level flaws, they equally affect all software platforms, being Windows, MacOS, Android, or anything else.

So, are our Androids safe against Spectre and Meltdown flaws? Read below to find more information about Meltdown and Spectre, and possible solutions to them.

How Meltdown and Spectre Work

These threats take advantage of a modern microprocessor feature known as Speculative Instruction Execution (SIE). This feature allows a processor to “speculate” the result of a given condition and execute instructions accordingly. If the speculated result appears later to be wrong, the processor just drops the executed instructions. While this behavior appears weird at first, it can speed up operations significantly. This is because speculated results enter the processor’s cache and are faster to access if needed.

However, it now appears that SIE is vulnerable to Malware attacks. Meltdown can access data stored in the processor’s cache by SIE and allows user programs to read sensitive kernel memory data. While processors from Intel, AMD, and ARM all use SIE to some extent, only Intel’s processors appear to be vulnerable to Meltdown. This is due Intel’s SIE implementation. AMD has officially stated that their processors are safe. Moreover, ARM reported that some of its processors might be exposed and they provided some patches against Meltdown to the ARM Linux kernel.

Meltdown can be controlled, although it is a huge threat. Things will not be easy with Spectre though. Spectre performs a more general attack against SIE, using some sophisticated coding techniques. Intel, AMD and ARM processors are all vulnerable to it. To avoid Spectre attacks, all processor instructions must be executed without any kind of speculation. All processor architectures support this configuration through additional instructions, but finding the correct place to put these instructions in OS code will not be an easy task. It will surely take some time until software hacks to protect users from Spectre become available.

Is your Android Safe Against Spectre and Meltdown Flaws?

As mentioned above, Linux kernel patches against Meltdown are already available. Furthermore, Google stated that the January 5th security patch will include a fix for Meltdown. If you are using an Android device that still receives updates from the manufacturer, you will get the patch sooner or later. If you are running a LineageOS-based ROM, you will also get protection soon.

We should mention that ARM processors did not appear vulnerable to Meltdown on research tests. So, even if your ARM device is quite old and does not receive updates, it might be safe against Meltdown. We need more information from ARM for conclusions though. If you are running Android on an Intel x86 device, you will surely be exposed unless you get the Linux kernel patch.

With Spectre, things are different. There is no patch available as of the time of this writing and it will take some time until developers close this security hole. Nearly all electronic devices featuring a microprocessor are vulnerable to this attack. If you are using an Android device that is receiving support from the manufacturer or the community, you might be lucky and receive updates for Spectre before support time runs out.

What will actually provide a complete fix for these new threats is a re-design of SIE. That includes changes to the hardware level, and more specifically the microprocessor circuit. It will need both time and money to pull off this effort though. Furthermore, there is zero chance for device recalls, as these issues affect billions of devices out there. The only real solution for users is upgrading all of their devices when safe hardware designs become available.