If you pay any attention to technology news, you’ve probably already heard of the recently discovered Meltdown and Spectre exploits that are reported to effect a majority of computer systems currently in operation, regardless of their operating system. Since the vulnerability is at it’s core, hardware-based, users of Macs, PC’s and some mobile devices are all at risk equally. The hardware in question are processors by Intel, AMD and ARM and the issue could be exploited in 3 ways known as Variants 1 and 2 (identified as Spectre) and Variant 3 (identified as Meltdown).

The way the Spectre exploit works is by taking advantage of the way your computer processor’s architecture is wired to execute code. In a very basic way, the processor’s job is to make a series of decisions very quickly and pass along the results of those decisions. To speed things up, most modern processors use a technique known as “branch prediction” to guess what the next decision it’s going to have to make is. This “speculative execution” greatly improves the speed of a processor as it can always stay a few steps ahead of the game. It’s not always correct in it’s predictions, but that doesn’t matter because the speed at which it does these predictions allows it to perform many, many of these per second.

In very simple terms, it’s all of these incorrect predictions that allow your sensitive data to be potentially revealed. When these bits of data are trashed, for just a moment, the state of your processor can be analyzed by some malicious agents and backtrack it’s way to what bits of data were used to arrive at it’s incorrect prediction. It can then exploit this method by making your processor arrive at incorrect predictions on purpose by injecting data far outside the bounds of what it expects and, in turn, grabbing more of your sensitive data with each execution.

Patches to guard against this involve an extra step every time your computer executes these kind of instructions, double checking to see if the data it’s executing lies within the bounds of what’s expected as well as separating the code and predictions into separate areas of memory. Different processor models have slightly different architectures and the exploits work in slightly different ways across them, however this is generally how things work.

Meltdown is much more clear-cut exploit. To run efficiently, data being run through different parts of your computer processor is stored in a cache as it’s passed between sections of your processor. Meltdown reads this cache and can take the information contained in it and send it off in another direction to be utilized for nefarious purposes. The fix for this involves splitting the address space for this shared memory so that the data is never complete and would appear as gibberish if it were captured, the downside to this fix is that it involves making your computer do twice the work for the same amount of processing. Fortunately, this type of shared memory space only occurs in an impactful way during specific I/O events such as disk-reads or network communication and has little effect on computationally-heavy computing such as video-editing or gaming.

New chipsets and operating-systems should be affected very minimally by any patches to eliminate these exploits, however older systems and certain cloud and virtualization computing systems could take a pretty big performance hit as they rely heavily on I/O to operate.

It’s not often that we see such a vulnerability so widespread and so tricky to fix. It’s something that has been baked into the core architecture of so many of our computer systems in slightly different ways and yet it exists almost universally between manufacturers. It’s like suddenly discovering that bare lightbulbs can steal your credit card number. Sure you can just say “use a lampshade” but lightbulbs come in different sizes and styles even though they all work pretty much the same way and even if you design a lampshade for every bare lightbulb out there, there will be slightly less light when fitted with a lampshade.