Loading story…
Researchers disclosed the Spectre and Meltdown CPU side-channel attacks, showing that speculative and out-of-order execution can transiently bypass security checks and leave protected data observable through microarchitectural state such as processor caches. The flaws affect isolation boundaries intended to protect kernel, process, and virtual-machine memory; Meltdown is tracked as CVE-2017-5754 and primarily affects Intel processors, while Spectre variants affect a broader range of Intel, AMD, and ARM designs.
Spectre Variant 2, CVE-2017-5715, uses branch-target injection to induce privileged code to speculatively access data and expose it through cache behavior, potentially crossing syscall and guest/host boundaries. Red Hat rated the vulnerability Important with a CVSS v3 score of 5.6 and released kernel fixes for supported Red Hat Enterprise Linux 5, 6, and 7 streams; organizations should apply vendor firmware, kernel, and virtualization mitigations appropriate to their processors and workloads.
Get the actors, campaigns, and ATT&CK mapping behind it.
27 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2018:1346 for RHEL 6.7 Extended Update Support, providing kernel 2.6.32-573.55.2.el6 updates that fix Meltdown (CVE-2017-5754) on 32-bit x86 and the kernel exception-handling denial-of-service flaw CVE-2018-8897. The update also used retpoline-capable GCC build requirements to mitigate Spectre Variant 2 (CVE-2017-5715).
Red Hat issued RHSA-2018:1252 to address CVE-2017-5715 in the RHEL 5.9 Long Life kernel.
Red Hat issued RHSA-2018:1196 to fix the CVE-2017-5715 kernel issue in Red Hat Enterprise Linux 5 Extended Lifecycle Support.
Red Hat issued RHSA-2018:0464, an Important kernel update for RHEL Server AUS 5.9 Long Life. Kernel 2.6.18-348.35.1.el5 added x86-64 software mitigations for Spectre Variant 1 (CVE-2017-5753) and Meltdown (CVE-2017-5754), along with page-table isolation and kernel stability fixes; affected systems required a reboot.
Red Hat issued RHSA-2018:0292, an Important advisory providing kernel 2.6.18-426.el5 software mitigations for Spectre Variant 1 (CVE-2017-5753), Spectre Variant 2 (CVE-2017-5715), and Meltdown (CVE-2017-5754) in RHEL 5 Extended Lifecycle Support. The mitigations covered applicable x86, x86-64, and s390 architectures and required a reboot after installation.
Red Hat issued RHSA-2018:0182 for RHEL 7.3 Extended Update Support and associated update-service channels, providing kernel 3.10.0-514.41.1.el7 mitigations for Spectre Variant 1, Spectre Variant 2, and Meltdown on IBM Power and IBM z Systems. The update also fixed XFS crash, IBM z Systems asynchronous-I/O, and iptables reload issues and required a reboot.
Red Hat issued RHSA-2018:0151 for the RHEL 7 kernel, providing initial software mitigations for Spectre Variant 1 (CVE-2017-5753), Spectre Variant 2 (CVE-2017-5715), and Meltdown (CVE-2017-5754), including architecture-specific coverage for IBM z Systems and IBM Power. The update also fixed five kernel flaws—CVE-2015-8539, CVE-2017-7472, CVE-2017-12192, CVE-2017-12193, and CVE-2017-15649—and required affected systems to reboot.
Red Hat issued RHSA-2018:0092, an Important kernel update for Red Hat CloudForms 4.0 x86_64 virtual machines, providing software mitigations for Spectre Variant 1 (CVE-2017-5753), Spectre Variant 2 (CVE-2017-5715), and Meltdown (CVE-2017-5754). The mitigations may impose a performance penalty and cannot fully eliminate the underlying processor hardware flaws.
Red Hat issued RHSA-2018:0089, an Important kernel update for Red Hat CloudForms 4.1 x86_64 virtual machines, providing software mitigations for Spectre Variant 1 (CVE-2017-5753), Spectre Variant 2 (CVE-2017-5715), and Meltdown (CVE-2017-5754). The mitigations may reduce performance and require applicable previously released errata to be installed.
Red Hat issued RHSA-2018:0090, an Important kernel update for Red Hat CloudForms 4.2 x86_64 virtual machines, providing software mitigations for Spectre Variants 1 and 2 and Meltdown (CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754). The mitigations could reduce performance and could not fully remediate the underlying hardware flaws.
Red Hat issued RHSA-2018:0091, an Important kernel update for Red Hat CloudForms 4.5 x86_64 virtual machines, providing software mitigations for Spectre Variant 1 (CVE-2017-5753), Spectre Variant 2 (CVE-2017-5715), and Meltdown (CVE-2017-5754). The mitigations apply to x86-64 systems and may impose a performance penalty.
Red Hat issued RHSA-2018:0047, an Important update for Red Hat Virtualization Host 4 on RHEL 7 x86_64, RHEV 4.x, RHEV-H, and associated RHEL 7 agents. The update supplied kernel software mitigations for Spectre Variants 1 and 2 and Meltdown (CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754), while warning of potential performance impact and incomplete software remediation of the hardware flaws.
Red Hat issued RHSA-2018:0046, an Important update for rhev-hypervisor7 in Red Hat Virtualization ELS 6 and ELS 7. Versions 7.3-20180102.1.el6ev and 7.3-20180102.1.el7ev supplied software mitigations for Spectre Variants 1 and 2 and Meltdown (CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754).
Red Hat issued RHSA-2018:0044, an Important update for Red Hat Virtualization Host in Red Hat Virtualization 7 and RHEV 3.X Hypervisor and Agents for RHEL 7. It supplied kernel-level mitigations for Spectre Variants 1 and 2 (CVE-2017-5753 and CVE-2017-5715) and Meltdown (CVE-2017-5754), with potential performance impact.
Red Hat issued RHSA-2018:0045, an Important advisory updating rhvm-appliance for the RHV-M Virtual Appliance in Red Hat Virtualization 4 and Red Hat Virtualization Host 4 on RHEL 7 x86_64. The update provided software mitigations for Spectre Variants 1 and 2 and Meltdown (CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754).
Red Hat issued RHSA-2018:0021 for Red Hat Enterprise MRG 2 x86_64, updating kernel-rt to version 3.10.0-693.11.1.rt56.606.el6rt. The update mitigated Spectre Variants 1 and 2 and Meltdown (CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754), required a reboot, and warned of possible performance impact.
Red Hat released fixes for CVE-2017-5715 in RHEL 6.2, 6.4, 6.5, and 6.6 update-support streams, as well as the kernel-rt package for RHEL 7, through RHSA-2018:0020, RHSA-2018:0018, RHSA-2018:0022, RHSA-2018:0017, and RHSA-2018:0016.
The CVE record for CVE-2017-5715 was published, describing a Spectre Variant 2 information-disclosure vulnerability in Intel speculative-execution processors. A local attacker could use side-channel analysis involving indirect branch prediction to access otherwise inaccessible information.
Red Hat issued RHSA-2018:0010 for RHEL 7.2 AUS, TUS, and Update Services for SAP Solutions x86_64 channels. Kernel 3.10.0-327.62.4.el7 provided software mitigations for Spectre Variants 1 and 2 and Meltdown (CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754); installation required a reboot and could reduce performance.
Red Hat issued RHSA-2018:0009 for RHEL 7.3 Extended Update Support and related AUS, TUS, Compute Node, and SAP service channels. Kernel 3.10.0-514.36.5.el7 supplied x86-64 software mitigations for Spectre Variants 1 and 2 and Meltdown (CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754), requiring a reboot and potentially reducing performance.
Red Hat issued RHSA-2018:0011 for RHEL 6.7 Extended Update Support, supplying kernel 2.6.32-573.49.3.el6 mitigations for Spectre Variant 1 (CVE-2017-5753), Spectre Variant 2 (CVE-2017-5715), and Meltdown (CVE-2017-5754). The update required a reboot and warned that software mitigations could reduce performance.
Petr Matousek reported Red Hat Bug 1519781, tracking CVE-2017-5754 (Meltdown), to Red Hat. The issue concerns speculative-execution permission-fault handling that can allow local attackers to infer privileged kernel memory through cache side channels.
Red Hat documented CVE-2017-5754 (Meltdown), which can allow a low-privileged local attacker to read privileged kernel memory on affected Intel x86-64 processors via a cache side channel. Red Hat issued kernel fixes for multiple RHEL releases, while stating it does not plan to mitigate 32-bit RHEL 5 because the required changes would be excessively invasive and destabilizing.
Red Hat documented CVE-2018-8897, a Linux kernel exception-handling flaw involving x86 MOV SS or POP SS stack switches that could let an unprivileged local user crash the kernel. It listed fixes across multiple RHEL 5, 6, and 7 streams, Red Hat Enterprise MRG 2, and Red Hat Virtualization 4, in addition to noting Fedora's 4.16-rebase fix and the upstream patch.
Red Hat issued RHSA-2018:1319 for RHEL 6 and RHSA-2018:1346 for RHEL 6.7 Extended Update Support, fixing the CVE-2017-5715 kernel issue.
Red Hat issued RHSA-2018:0512 for Red Hat Enterprise Linux 6 and RHSA-2018:0496 for RHEL 6.7 Extended Update Support to fix the Spectre Variant 1 bounds-check-bypass vulnerability, CVE-2017-5753.
Red Hat tracked CVE-2017-5753, the Spectre Variant 1 bounds-check-bypass vulnerability, and issued advisories for affected RHEL 6 and 7 streams, Red Hat Virtualization, Red Hat Enterprise MRG, and CloudForms Management Engine. The vulnerability could allow an unprivileged local attacker to infer privileged memory through speculative execution and cache side channels.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
43 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcearxiv.org
Open sourcearxiv.org
Open sourceaccess.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed the **Meltdown** and **Spectre** hardware flaws, showing that speculative execution in modern processors could let attackers read sensitive data across security boundaries on affected devices. Reuters reported that **Meltdown** primarily affected Intel processors by breaking memory isolation, while **Spectre** impacted Intel, AMD, and ARM chips by tricking applications into leaking secrets such as passwords and other protected data. CERT/CC later summarized the broader issue as cache side-channel attacks against CPU hardware using speculative execution, underscoring that the weakness was architectural rather than limited to a single product line. Major vendors and cloud providers moved to contain the fallout with software, firmware, and microcode mitigations, including Microsoft Azure protections for hosted customers and public advisories from manufacturers such as Huawei. Subsequent research showed the problem persisted beyond the initial disclosures: the **ZombieLoad** attacks demonstrated additional Intel data-leakage paths tied to speculative execution, and a later **TSX Asynchronous Abort (TAA)** variant affected some processors previously thought to be resistant. Intel issued microcode updates, but researchers and vendors warned that mitigations reduced rather than eliminated risk, that exploitation generally required local code execution, and that fully disabling the underlying CPU behavior would carry significant performance costs.
Jun 29, 2026
Researchers disclosed the speculative-execution attacks **Meltdown** (`CVE-2017-5754`) and **Spectre** (`CVE-2017-5753`, `CVE-2017-5715`), showing that modern Intel, AMD, and ARM processors could leak sensitive data across privilege boundaries through cache-timing side channels. Google Project Zero demonstrated kernel and virtual-machine memory disclosure, while browser vendors including Mozilla confirmed that web content could abuse similar techniques, prompting Firefox to reduce timer precision and disable `SharedArrayBuffer` by default. Microsoft, Apple, Linux distributors, cloud providers, and hardware vendors issued operating-system, browser, and microcode mitigations, with Microsoft saying Azure had already been updated and Intel later announcing hardware changes for future chips. Early mitigation rollouts brought significant operational concerns, including uneven performance degradation and unstable firmware updates. Linux and macOS testing found that common desktop benchmarks often changed little, but syscall-heavy, storage, and IO-intensive workloads could slow noticeably, with some macOS microbenchmarks degrading by roughly **2x to 4x** and Windows Server or older systems expected to see larger impacts than newer Windows 10 devices. Intel’s early Spectre-related microcode updates were later linked to reboots and possible data corruption, leading Microsoft to publish an emergency update that disabled one mitigation path, while vendors such as Dell and NetApp tracked product exposure and remediation guidance as the industry continued responding to follow-on speculative-execution issues.
Aug 8, 2026
Researchers and industry reporting revealed that Intel processors were affected by a broader set of speculative-execution vulnerabilities beyond the original **Meltdown** and **Spectre** disclosures, including eight additional issues dubbed **Spectre-NG**. Several of the newly reported flaws were described as high risk, with at least one capable of crossing virtual machine boundaries and threatening cloud environments by exposing sensitive data such as passwords and cryptographic keys; reports also said Intel **SGX** protections were not sufficient against some of these attacks. The wider Spectre/Meltdown family affected Intel most heavily for Meltdown and Intel, AMD, and Arm for Spectre, reinforcing warnings that complete remediation would ultimately require hardware changes rather than software alone.
Jun 29, 2026