Microsoft says that it will continue to keep an eye on the impact of these vulnerabilities and launch more mitigations it deems necessary. Spectre refers to one of the two original transient execution CPU vulnerabilities (the other being Meltdown ), which involve microarchitectural timing side-channel attacks. These fixes are part of security updates Microsoft has already issued in response to the exploits' disclosure. These vulnerabilities can be exploited to steal sensitive data present in a computer systems' memory. These two changes substantially increase the difficulty of successfully inferring the content of the CPU cache from a browser process. On January 3, 2018, the National Cybersecurity and Communications Integration Center (NCCIC) became aware of a set of security vulnerabilitiesknown as Meltdown and Spectre that affect modern computer processors.
#Microsoft spectre meltdown windows 10#
Initially, we are removing support for SharedArrayBuffer from Microsoft Edge (originally introduced in the Windows 10 Fall Creators Update), and reducing the resolution of performance.now() in Microsoft Edge and Internet Explorer from 5 microseconds to 20 microseconds, with variable jitter of up to an additional 20 microseconds.
To mitigate the attacks in its browsers, Microsoft is has made a couple of changes to both Edge and Internet Explorer: Through these techniques, attackers can use JavaScript code in a browser to potentially read memory on a user's machine. The vulnerabilities, Microsoft says, can be exploited by techniques known as speculative execution side-channel attacks.
0 kommentar(er)
