Resources for Mitigating Meltdown and Spectre Vulnerabilities

Microsoft

Azure: https://azure.microsoft.com/en-us/blog/securing-azure-customers-from-cpu-vulnerability/

Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/adv180002

Cloud KB: https://support.microsoft.com/en-us/help/4073235/cloud-protections-speculative-execution-side-channel-vulnerabilities

Azure Blog: https://azure.microsoft.com/en-us/blog/securing-azure-customers-from-cpu-vulnerability/

Surface Guidance: https://support.microsoft.com/en-us/help/4073065/surface-guidance-for-customers-and-partners-protect-your-devices-again

AV KB: https://support.microsoft.com/help/4072699

Server KB: https://support.microsoft.com/en-us/help/4072698/windows-server-guidance-to-protect-against-the-speculative-execution-s

Windows Client KB: https://support.microsoft.com/en-us/help/4073119/windows-client-guidance-for-it-pros-to-protect-against-speculative-exe

Edge Blog: https://blogs.windows.com/msedgedev/2018/01/03/speculative-execution-mitigations-microsoft-edge-internet-explorer/

Protecting Devices (Consumer): https://support.microsoft.com/en-us/help/4073229/windows-protect-device-against-chip-related-security-vulnerability

Research

Google Blog: https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html

GPZ Blog: https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html

Researcher Site: https://meltdownattack.com/ / https://spectreattack.com/

Advisories & Communications

Cloud Providers

AWS: https://aws.amazon.com/security/security-bulletins/AWS-2018-013/

Digital Ocean: https://blog.digitalocean.com/a-message-about-intel-security-findings/

Rackspace: https://blog.rackspace.com/rackspace-is-tracking-vulnerabilities-affecting-processors-by-intel-amd-and-arm

Google: https://blog.google/topics/google-cloud/what-google-cloud-g-suite-and-chrome-customers-need-know-about-industry-wide-cpu-vulnerability/

IBM: https://www.ibm.com/blogs/psirt/potential-cpu-security-issue/

 

Hypervisors

VMWare: https://www.vmware.com/us/security/advisories/VMSA-2018-0001.html

Xen: https://xenbits.xen.org/xsa/advisory-254.html

 

Operating Systems

RedHat: https://access.redhat.com/errata/RHSA-2018:0010

Ubuntu: https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown

 

Hardware

ARM: https://developer.arm.com/support/security-update

ARM Whitepaper: https://armkeil.blob.core.windows.net/developer/Files/pdf/Cache_Speculation_Side-channels.pdf

ARM: https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Security-Advisory-TFV-6

ARM: https://github.com/ARM-software/tf-issues/issues/541

nVidia: https://forums.geforce.com/default/topic/1033210/nvidias-response-to-speculative-side-channels-cve-2017-5753-cve-2017-5715-and-cve-2017-5754/

Intel: https://newsroom.intel.com/news/intel-responds-to-security-research-findings/

AMD: https://www.amd.com/en/corporate/speculative-execution

 

Browsers

Google Chrome: https://www.chromium.org/Home/chromium-security/ssca

Mozilla Firefox: https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/

 

Mobile Devices

Android: https://source.android.com/security/bulletin/2018-01-01

 

Databases

Postgresql: https://www.postgresql.org/message-id/20180102222354.qikjmf7dvnjgbkxe@alap3.anarazel.de

 

CERTS

CERT/CC: https://www.kb.cert.org/vuls/id/584653

US CERT: https://www.us-cert.gov/ncas/current-activity/2018/01/03/Meltdown-and-Spectre-Side-Channel-Vulnerabilities