Meltdown and Spectre Attacks
Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs.
Affected Products and Versions
All versions of Cloud Foundry are potentially affected. More information will be added to this page as it is made available.
- Mitigations for these issues are expected to be necessary at several levels, including infrastructure and operating systems. Information for major providers is available on the Meltdown/Spectre website .
- The Cloud Foundry Project intends to provide new versions of stemcells as soon as updates are released upstream.
- Update: As of January 24, BOSH stemcells for Ubuntu  have been released to mitigate Meltdown and Spectre. Further releases from Ubuntu are possible but none are currently expected. 
- Windows stemcells v1200.13 available on bosh.io address Microsoft’s guidance for protection against “speculative execution side-channel vulnerabilities” . For vSphere, see instructions for building the stemcell .
See the following table for information related to specific infrastructures. We will update this table as more information is available.
|Cloud Provider||Hypervisor Patch Status|
|Amazon AWS||AWS hypervisors are now mostly protected and require VM instance restarts|
|Google Cloud||Google infrastructure is patched and used live migration for VM instance restarts|
|Microsoft Azure||Azure mostly updated and requires VM instance restarts|
|OpenStack||OpenStack Vendor dependent|
|VMWare vSphere||See VMWare knowledge base article for updates|
-  https://meltdownattack.com and https://spectreattack.com
-  https://googleprojectzero.blogspot.ca/2018/01/reading-privileged-memory-with-side.html
-  http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5715
-  http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5753
-  http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-5754
-  https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown
-  https://www.cloudfoundry.org/usn-3522-2/
-  https://bosh.io
-  https://support.microsoft.com/en-gb/help/4072698/windows-server-guidance-to-protect-against-the-speculative-execution
-  https://github.com/cloudfoundry-incubator/bosh-windows-stemcell-builder/wiki/Creating-a-vSphere-Stemcell-by-Hand
-  https://www.cloudfoundry.org/blog/usn-3540-2/