Cybersecurity glossary
What is Meltdown?
Learn what Meltdown is, how transient execution allowed user programs to infer kernel memory, how it differs from Spectre, which systems were affected, and which mitigations closed the gap.
Definition
Meltdown is a transient execution vulnerability in which a user-space program can transiently access privileged kernel memory and recover its contents through microarchitectural side channels—breaking the isolation between user applications and the operating system kernel on affected CPUs.
Why Meltdown matters
Operating systems rely on the CPU to keep kernel memory out of reach of ordinary applications. Meltdown demonstrated that speculative execution on affected processors could transiently bridge that gap and leak kernel data through side channels.
Together with Spectre, Meltdown forced emergency patching across the industry and popularized Kernel Page Table Isolation as a default defense on many platforms.
How Meltdown leaks kernel memory
Run unprivileged code
Attacker-controlled user-space code executes on a vulnerable CPU.
Transiently touch kernel addresses
Speculative execution accesses privileged memory before the fault is resolved.
Leave cache footprints
Secret-dependent loads affect microarchitectural state such as caches.
Architecturally raise a fault
The illegal access is not supposed to retire—but side effects may remain.
Infer bytes via timing
Cache probes recover kernel memory contents bit by bit.
Impact themes
Kernel secret disclosure
Passwords, keys, and kernel data structures could be inferred from user space.
Shared machine risk
Multi-user servers and clouds were urgent patch targets.
KPTI mitigation cost
Stronger page-table isolation added overhead on some workloads.
Industry wake-up
Accelerated research into many later transient execution variants.
Defenses against Meltdown-class issues
| Control | Notes |
|---|---|
| KPTI / KAISER-style isolation | OS separates user and kernel mappings to block the classic Meltdown path |
| Microcode updates | CPU firmware changes complement OS mitigations where applicable |
| Patched kernels | Ensure production hosts report mitigations as enabled—not vulnerable |
| Hypervisor updates | Cloud and virtualization stacks need coordinated guest/host fixes |
| Least privilege hosts | Reduce who can run native code on sensitive machines |
| Continuous advisory watch | Related transient execution CVEs continue beyond the original Meltdown |
- Confirm OS Meltdown mitigations (e.g., KPTI) are active on servers.
- Apply CPU microcode and kernel updates from your vendor.
- Verify cloud instances inherit provider host mitigations.
- Include speculation status in configuration compliance checks.
- Keep hypervisors and management planes patched.
- Limit untrusted native code on hosts that handle sensitive tenants.
- Retest performance-sensitive services after mitigation changes.
- Track follow-on transient execution advisories, not only CVE-2017-5754.
The practical takeaway
Meltdown let user programs infer kernel memory on affected CPUs by combining speculative access with cache side channels. Kernel page-table isolation and vendor patches closed the original hole—verify those defenses remain enabled.
Treat Meltdown as the landmark proof that CPU speculation can break OS privilege boundaries, and keep transient-execution patching in your baseline hygiene.
Related security terms
Spectre
Companion speculative execution family disclosed alongside Meltdown.
Speculative Execution Attack
Broader class of CPU speculation side-channel attacks.
Side-Channel Attack
Parent category for cache-timing and related leakage techniques.
Privilege Escalation
Meltdown effectively bypassed a core privilege isolation boundary.
Frequently asked questions
What is Meltdown in simple terms?
On affected CPUs, a normal program could briefly touch kernel memory during speculative execution and then infer those bytes via cache timing—reading secrets that should only be visible to the OS.
How is Meltdown different from Spectre?
Meltdown specifically broke user/kernel memory isolation on vulnerable processors. Spectre covers a wider set of speculation tricks that can cross many software trust boundaries.
What CVE is Meltdown?
Meltdown is commonly tracked as CVE-2017-5754 (rogue data cache load).
What was KPTI?
Kernel Page Table Isolation (also known as KAISER-related work) separates user and kernel page tables more strongly so user speculation is less able to reach kernel mappings— a major OS-level Meltdown mitigation.
Are modern CPUs still vulnerable?
Newer designs and mitigations address the original Meltdown issue. Always verify current CPU/OS status; related transient execution issues continue to appear in other forms.
Did Meltdown require malware already on the machine?
Exploitation requires the ability to run code (or a scripting environment) on the target system. It is not a remote network packet by itself, but it is severe on shared hosts and multi-user systems.
What should defenders do today?
Keep OS kernels and microcode updated, confirm Meltdown mitigations are active, and maintain browser/hypervisor patches for related transient execution issues.
References
Explore authoritative guidance and frameworks related to meltdown.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.