Office 365 - Meltdown and Spectre CPU bugs

Trusted Contributor

No not the next Bond film, posted to the Office 365 Message center today "Information about Today's Announced Hardware Vulnerability" are details about the high profile hardware vulnerabilities named Meltdown and Spectre using speculative execution side-channel attacks, which affects all modern processors. Also there is a public web page with the same information - Microsoft Cloud Protections Against Speculative Execution Side-Channel Vulnerabilities.


Microsoft has reassured customers that there is no indication that Office 365 has been affected and have mitigations in-place to protect customers, as well as detection capabilities to intercept these attacks.  


The fixes that mitigate this problem from being exploited are thought to have a sizable hit on performance but it seems Microsoft has done this in a way that that shouldn't be noticeable based on the corresponding Azure information - Microsoft "are not seeing noticeable performance impact after the fix has been applied".


There are lots of details, for anyone wanting to read up on this issue, in Microsoft's Security Advisory - Guidance to mitigate speculative execution side-channel vulnerabilities.


"Speculative execution side-channel vulnerabilities can be used to read the content of memory across a trusted boundary and can therefore lead to information disclosure. There are multiple vectors by which an attacker could trigger the vulnerabilities depending on the configured environment.


Microsoft has been working with hardware and software makers to jointly develop mitigations to protect customers across Microsoft’s products and services. These mitigations prevent attackers from triggering a weakness in the CPU which could allow the contents of memory to be disclosed."


It's important customers apply all available updates and follow the advice here to protect clients as well -  Windows Client Guidance for IT Pros to protect against speculative execution side-channel vulnerabil.... There is also corresponding guidance for servers as well.  Microsoft Edge and IE are affected and details on the fix are here.

0 Replies