16

While Apple has yet to comment on the flaw, Alex Ionescu, Windows security expert, noted a fix was present in a new 10.13.3 update to macOS.

source: How to Protect Yourself From Meltdown and Spectre, the Latest Processor Security Flaws

Improve this question
0

2 Answers 2

Reset to default
15

Meltdown

macOS patched December 6, 2017 in macOS 10.13.2
iOS patched December 2, 2017 in iOS 11.2

Apple patched CVE-2017-5754 (Meltdown) in macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan. (Support Article HT208331)

Spectre

As of January 8th, Apple has released updates for Safari on macOS and iOS to minimize the effectiveness of Spectre. (Support Article HT208394) Note that Spectre cannot be "patched", only more difficult to execute.

Improve this answer
5
  • 4
    It's inaccurate to suggest that Apple is going to "patch Spectre". Spectre is more of a methodology than a single exploit. Apple is developing a patch for Safari which will make this technique harder to execute using JavaScript. Actually stopping all Spectre type attacks requires hardware changes.
    – MJeffryes
    Jan 5, 2018 at 15:35
  • 3
    This information is incorrect: Apple has revised their security update notes. Sierra and El Capitan are not yet patched for Meltdown.
    – lunixbochs
    Jan 5, 2018 at 20:37
  • 2
    Has Apple indicated if they will patch macOS < 10.13 or iOS < 11? Or are those users going to remain vulnerable?
    – Thunderforge
    Jan 5, 2018 at 21:29
  • The support article HT208331 did, for a day, include Sierra and ElCap. but it no longer does so. This answer is wrong.
    – Gilby
    Jan 9, 2018 at 22:41
  • has anyone noticed the slowdown in performance after upgrading to 10.13.3? Several of my fortran-coded applications are found with obvious slowdown: the running time is almost doubled.
    – sunt05
    Jan 24, 2018 at 21:38
10

As posted in another, similar security related post, it's Apple's policy to not comment on security vulnerabilities until they are patched, and even when they do, they are often quite vague about it.

About Apple security updates

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

So, the comment in the linked article, should be viewed with (little) skepticism:

While Apple has yet to comment on the flaw, Alex Ionescu, Windows security expert, noted a fix was present in a new 10.13.3 update to macOS.

However, with a little detective work, we can gain some insight. Looking at the CVEs assigned to this particular vulnerability,* we can get listing of the issues that should be addressed by Apple when they decide to issue a security patch: There are three CVE's assigned to these issues:

  • CVE-2017-5753 and CVE-2017-5715 are assigned to Spectre. There's currently no patch available. However, according to Apple, the vulnerability is "very difficult to exploit" but can be done via Javascript. As such, they will issue an update for Safari on macOS and iOS in the future

    Apple will release an update for Safari on macOS and iOS in the coming days to mitigate these exploit techniques. Our current testing indicates that the upcoming Safari mitigations will have no measurable impact on the Speedometer and ARES-6 tests and an impact of less than 2.5% on the JetStream benchmark.

  • CVE-2017-5754 is assigned to Meltdown. This has been patched with macOS High Sierra 10.13.2 ONLY. Sierra and El Capitan are not yet patched.

TL;DR

Meltdown has been patched in the most recent updates to macOS High Sierra. Sierra and El Capitan are currently unpatched

Spectre is unpatched, but very difficult to execute though it can be exploited in Javascript. Ensure you update your browsers (like Firefox, Chrome, etc.) when and where applicable in addition to the updates provided from Apple.

*Common Vulnerabilities and Exposures (CVE®) is a list of common identifiers for publicly known cyber security vulnerabilities. Use of "CVE Identifiers (CVE IDs)," which are assigned by CVE Numbering Authorities (CNAs) from around the world, ensures confidence among parties when used to discuss or share information about a unique software vulnerability, provides a baseline for tool evaluation, and enables data exchange for cyber security automation.

Improve this answer
4
  • 1
    As steve's answer points out, CVE-2017-5754 is now listed as having been patched in the macOS 10.13.2 update - presumably this was added since you posted. With this being the accepted answer it might be good to update it to reflect the change.
    – David Z
    Jan 5, 2018 at 5:35
  • @DavidZ - Thanks for that. When I typed up the answer, those updates weren't posted to Apple's site
    – Allan
    Jan 5, 2018 at 12:12
  • 2
    This information is incorrect: Apple has revised their security update notes. Sierra and El Capitan are not yet patched for Meltdown.
    – lunixbochs
    Jan 5, 2018 at 20:37
  • @lunixbochs - TY. I have updated the information in my answer accordingly.
    – Allan
    Jan 5, 2018 at 21:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .