The tech world has been abuzz with news of a new set of critical exploits, dubbed Meltdown and Spectre, that, between them, impact nearly every modern processor in some manner. Following the disclosure of the exploits, Microsoft was quick to launch an emergency patch for Windows users and its cloud services. Now, Microsoft has explained how it has also worked to counter this class of attacks in Internet Explorer and Microsoft Edge.
The vulnerabilities, Microsoft says, can be exploited by techniques known as speculative execution side-channel attacks. Through these techniques, attackers can use JavaScript code in a browser to potentially read memory on a user's machine. To mitigate the attacks in its browsers, Microsoft is has made a couple of changes to both Edge and Internet Explorer:
Initially, we are removing support for SharedArrayBuffer from Microsoft Edge (originally introduced in the Windows 10 Fall Creators Update), and reducing the resolution of performance.now() in Microsoft Edge and Internet Explorer from 5 microseconds to 20 microseconds, with variable jitter of up to an additional 20 microseconds. These two changes substantially increase the difficulty of successfully inferring the content of the CPU cache from a browser process.
These fixes are part of security updates Microsoft has already issued in response to the exploits' disclosure. Microsoft says that it will continue to keep an eye on the impact of these vulnerabilities and launch more mitigations it deems necessary.
