Meltdown and Spectre Opened a Door That Won't Fully Close
Seven years on from the chip flaws that rewrote the rules of hardware security, dozens of variants keep arriving. Here's what ordinary users need to understand about vulnerabilities baked into the silicon itself.
Key points
- Three original CVEs (CVE-2017-5753, CVE-2017-5715, CVE-2017-5754), all published 4 January 2018, sit at the root of a family of hardware flaws that now numbers in the dozens.
- Speculative execution, a speed trick built into virtually every modern processor, is the shared design choice that makes all three exploitable.
- Some variants require microcode updates (low-level chip programming), some require only operating system patches, and a few can't be fully fixed without replacing the hardware.
- The vulnerability family has grown steadily since 2018, with named variants still appearing years later.
- Cloud users face heightened risk because many virtual machines share the same physical chip and the same memory cache.
On 4 January 2018, chip makers Intel, AMD and ARM confirmed what security researchers had quietly known for months: the speed trick at the heart of almost every modern processor also let an attacker read memory that should have been off-limits. Two names stuck, Meltdown and Spectre. Within days, every major operating system was rushing out emergency patches, with CPU makers, device manufacturers and OS vendors all scrambling in parallel. It was one of the largest patch coordination efforts in computing history.
What nobody said plainly at the time: the design flaw was so deeply embedded in how processors work that patches could blunt it, not cure it.
What is speculative execution, and why does it matter?
Speculative execution is a performance trick. Rather than wait for one instruction to finish before starting the next, a processor guesses what will probably come next and runs it early. A correct guess delivers a speed boost. A wrong one gets discarded, and nobody's supposed to notice.
That word "supposed" is doing a lot of work.
Even when a chip discards a wrong guess, faint traces of the computation linger in the processor's cache, a small fast-memory store the chip keeps close to hand. A careful attacker can read those traces using side-channel analysis, watching the chip's behaviour from the outside the way you might guess what someone is cooking by the smell leaking under the door.
CVE-2017-5753, the first Spectre variant, exploits branch prediction to pull information from one process that should never reach another. It affects Intel, IBM and a limited number of ARM CPUs. CVE-2017-5715 achieves the same outcome via branch target injection and needs a microcode update delivered directly to the chip's own programming to fix properly. Meltdown, CVE-2017-5754, takes a different angle entirely: an ordinary program can read protected memory belonging to the operating system kernel, the privileged core of the OS that should be completely walled off from normal software. All three carry a CVSS score of 5.6 out of 10, rated medium severity, a score that privacy advocates argued was far too low given the breadth of exposure.
Should ordinary users still be worried?
For a home user running a patched machine, the immediate practical risk is low. Exploiting these flaws typically requires the attacker to already be running code on your device, which is a high bar.
Cloud environments are a different story. When a single physical server runs dozens of virtual machines (software-simulated computers sharing one physical chip), the shared cache becomes a shared vulnerability. A malicious tenant on a cloud platform could, in theory, spy on a neighbouring tenant's encryption keys or login tokens.
Since 2018, researchers have kept coming. Foreshadow (CVE-2018-3620, CVE-2018-3646) drains Intel's L1 data cache and is especially dangerous in virtual machine environments. The MDS family, covering Fallout, RIDL and ZombieLoad, samples data from internal CPU buffers that even the chip's own designers treated as invisible to software. Each new variant has required a fresh round of microcode and OS updates. We've tracked this expanding family across our hardware security coverage since June, and the list hasn't stopped growing.
The honest read: hardware vendors have been patching around a design philosophy, not fixing the philosophy itself. Every new chip generation has partially addressed these issues. Every few months, a researcher publishes proof that the job isn't done.
What affected users should do
Keep your device's operating system and firmware current. For Windows machines that means Windows Update; Mac users should check System Settings, then General, then Software Update. Servers and cloud instances need both OS patches and any vendor-supplied microcode updates applied.
Cloud operators should verify with their provider that hypervisor-level mitigations (protections at the layer managing virtual machines) are current. Most major providers patched the original flaws quickly, but each new variant demands fresh action.
Organisations running older Intel hardware the manufacturer has declared out of support face a harder ceiling. Some variants can't be patched at all without replacing the equipment. That's the uncomfortable limit of what software can fix when the problem lives in the silicon.
