Meltdown
/ MELT-down /
The privilege boundary is supposed to be absolute: a user program cannot read the operating-system kernel's memory, because the CPU checks permission on every access and refuses if you are not allowed (see privilege-level and memory-protection). Meltdown, disclosed alongside Spectre in 2018, is the unsettling discovery that on many processors this permission check happened too late to matter for a side channel. The CPU would speculatively use the forbidden data before the check finished, and even though it threw the result away on realizing the access was illegal, the data had already left a trace in the cache.
Mechanically: a user program issues a load of a kernel address it is not permitted to read. Out-of-order execution, racing ahead, fetches that kernel byte and forwards it to a dependent instruction — which uses the secret byte to index an array, pulling one secret-dependent cache line in — all before the permission check resolves. When the check finally fires, the CPU raises a fault and squashes the architectural effects, so the program officially never read the kernel data. But the cache line is warm. A cache-timing measurement (Flush+Reload) then recovers the kernel byte from the cache state. Repeat across addresses and a user program can dump kernel memory it was categorically forbidden to see (see cache-timing-attack).
Why Meltdown is taught honestly as distinct from Spectre: Meltdown broke the user-versus-kernel privilege barrier directly, on affected chips, which is why it was patchable in software at a steep price. The fix, KPTI (kernel page-table isolation), simply stops mapping kernel memory into a user process's address space at all, so there is nothing for the speculative load to read — but this makes every system call more expensive, with real slowdowns on some workloads. Crucially, Meltdown was largely a flaw of how certain processors ordered the permission check relative to speculation; newer designs check before forwarding and are not vulnerable. Spectre, by contrast, is intrinsic to speculation and far harder to eliminate. Both, though, taught the same hard lesson: the microarchitecture can leak across a boundary the ISA promised was solid.
A user program executes: byte secret = *(kernel_address); y = probe[ secret x 256 ]. It has no right to read kernel_address, so a fault is inevitable. But out-of-order execution forwards the kernel byte to the second line and caches probe[secret x 256] before the fault is delivered. The program catches the fault, then times accesses across probe: the one fast line reveals secret — a byte of kernel memory read from user mode.
The illegal read is squashed, but it cached one line first — the permission check came too late to stop the side channel.
Unlike Spectre, Meltdown stemmed from checking permission too late relative to speculation, so it was mitigable in software (KPTI) and newer CPUs that check before forwarding are immune — but the fix taxes every system call. 'Patched' here means slower, not free.