Intel claims its new security updates make PCs ‘Immune’ to Meltdown and Spectre CPU bugs

Intel says it and its partners have “made significant progress” in rolling out security patches and firmware updates to protect against two major CPU bugs. The flaws were disclosed by Google’s Project Zero team this week, and the industry is scrambling to issue fixes and secure machines for customers. Dubbed “Meltdown” and “Spectre,” the flaws affect nearly every device made in the past 20 years, and could allow attackers to use JavaScript code running in a browser to access memory in the attacker’s process. That memory content could contain key strokes, passwords, and other valuable information.



Intel says it has developed and is issuing updates for all types of Intel-based machines that will “render those systems immune from both exploits (referred to as ‘Spectre’ and ‘Meltdown’) reported by Google Project Zero. “Intel has already issued updates for the majority of processor products introduced within the past five years,” says an Intel spokesperson. “By the end of next week, Intel expects to have issued updates for more than 90 percent of processor products introduced within the past five years.”

Intel’s reference to “immune” is an interesting twist in this saga. The New York Times reported yesterday that Spectre fixes will be a lot more complicated as they require a redesign of the processor and hardware changes, and that we could be living with the threat of a Spectre attack for years to come. Intel’s wording appears to suggest that this isn’t the case for its own processors and security fixes.

Microsoft has started rolling out its own Windows 10 security patches, alongside software updates for Firefox and an update coming to Chrome later this month. Apple has not yet commented publicly on the bugs, but AppleInsider reports that Apple has already deployed a partial fix for the security bug in macOS 10.13.2. More changes are expected to come with 10.13.3 soon.

While the industry continues to patch both of the Meltdown and Spectre problems, there has been a lot of discussion about possible PC slow downs. “Intel continues to believe that the performance impact of these updates is highly workload-dependent and, for the average computer user, should not be significant and will be mitigated over time,” says Intel. “While on some discrete workloads the performance impact from the software updates may initially be higher, additional post-deployment identification, testing and improvement of the software updates should mitigate that impact.”

Most modern CPUs don’t appear to be generating any performance dips on the Windows side, but there’s continued speculation about Linux-based PCs and virtual machines used for cloud computing. After Intel’s response yesterday, some Linux admins are reporting performance impacts. It’s still early in the process to get a better overview of the impact, but if 90 percent of processor products are patched by the end of next week we’ll have a better idea on the legitimate issues that could arise from these kernel changes. Until then, Intel says it “will continue to work with its partners and others to address these issues.”