What’s the problem?
The problem is what’s called Speculative Execution – a feature of a processor designed to improve performance by guessing what the processor is likely to be needed for next and trying to pre-fetch some of that data. A flaw in this process allows an unauthorised individual to read kernel level memory from the processor.
What this means that even a browser-based JavaScript can read this information; just browsing a website with the wrong JavaScript file loaded could dump all the data out of your processor. This is bad enough on a single machine. In a shared environment where VMware ESXi, Hyper-V or another hypervisor is in use, it could return data from the CPU about other virtual machines on the host. In a cloud environment, such as Amazon AWS EC2 instances or Microsoft Azure IaaS VMs, this could allow data to be read back from a VM belonging to another tenant running on the same host.
Who’s fixing it?
It appears that the fix has to come from the operating system vendors such as Linux and Microsoft and requires them to rewrite a portion of the OS kernel. The Microsoft hotfix for the issue has already been released for Windows 7 SP1 and all later operating systems, including client and server variants.
The downside is that reports so far are showing that performance of certain I/O operations will be impacted by between 5 and 30 percent once the patch is applied, with database and file servers most likely to take the hit. We’ll continue to monitor this as the situation develops.
What are we doing?
Since becoming aware of this on Wednesday, our engineers have been proactively reviewing all our managed services. For the backend host infrastructure we are currently progressing the required remediation.
We urge customers where patching is not part of their current service, to check details around this vulnerability for their vendor and ensure that their systems are secured. Further details can be found here. We’ll contact customers individually to discuss any remediation work that is identified, depending on the results of our scans.
If your contract does not include patching services and/or Desktop as a Service, or are not currently a Fordway customer our Consultancy services can provide help. Please contact us for more information.