Is the Raspberry Pi Vulnerable to the Spectre or Meltdown exploit?

e14phil — Tue, 09 Jan 2018 11:05:12 GMT

Current Revision posted to Documents by e14phil on 1/9/2018 11:05:12 AM

On January 3rd 2018 a loose group of Jann Horn, Paul Kocher, Daniel Genkin, Mike Hamburg, Moritz Lipp and Yuval Yarom came together to make

the public aware of, what seems to be, one of the most serious computer security vulnerability to date. These vulnerabilities, named "Spectre" and "Meltdown", allow programs access to any data in any location on the device, even areas which the operating environment specifically would block programs from accessing.

The reason this vulnerability is seen as so serious is because it is at processor level, which makes it hard to patch.

This vulnerability effects all Apple iPhones, iPad, or Macbooks, most Intel processors and by extension some Arm Cortex processors.

As some Arm processors are used in, ALL Raspberry Pi, are the Arm Processors in the Raspberry Pi Vulnerable to the Spectre or Meltdown exploit?

I will save you the Click Bait...

Short answer is NO,

None of the Variants of the Raspberry Pi. (as of 5th January 2018) are vulnerable to Spectre or Meltdown exploit.

According to Arm directly:

https://developer.arm.com/support/security-update

The processor used by the Raspberry Pi are:

Raspberry Pi 1 and Zero (W): ARM11

Raspberry Pi 2 V1: ARM Cortex-A7

Raspberry Pi 2 V1.2 ARM Cortex-A53

Raspberry Pi 3: ARM Cortex-A53

The good news for Raspberry Pi users is that these are NOT on Arm's Definitive list of vulnerable processors:

Vulnerable Processors:

Processor	Variant 1	Variant 2	Variant 3	Variant 3a
Cortex-R7	Yes*	Yes*	No	No
Cortex-R8	Yes*	Yes*	No	No
Cortex-A8	Yes (under review)	Yes	No	No
Cortex-A9	Yes	Yes	No	No
Cortex-A15	Yes (under review)	Yes	No	Yes
Cortex-A17	Yes	Yes	No	No
Cortex-A57	Yes	Yes	No	Yes
Cortex-A72	Yes	Yes	No	Yes
Cortex-A73	Yes	Yes	No	No
Cortex-A75	Yes	Yes	Yes	No

* Note for Cortex-R cores: The common usage model for Cortex-R is in non-open environments where applications or processes are strictly controlled and hence not exploitable.

*Source https://developer.arm.com/support/security-update

I hope this slice of good news helps one of you concerns...... Unlike all Apple iPhones, iPad, or Macbooks, which are all vulnerable.

Please make sure you do not put off security updates!

More info: https://support.apple.com/en-us/HT208394

-e14Phil

Tags: meltdown, spectre, raspberry pi, cyber security, arm