Apple has confirmed all its Mac systems and iOS devices are affected by two recently disclosed processor flaws called Spectre and Meltdown.
In an announcement on Thursday, Apple said it has released mitigations to defend against Meltdown in iOS 11.2, macOS 10.13.2, and tvOS 11.2. It will release mitigations in Safari to defend against the Spectre bug “in the coming days,” the release said.
“There are no known exploits impacting customers at this time,” Apple said, echoing what other companies and security researchers have said.
Apple Watch isn’t impacted by the Meltdown flaw.
Researchers announced the two flaws affecting virtually all computer processors on Wednesday.
Here’s the issue: Modern processors are designed to perform something called “speculative execution” to enhance performance. Data is supposed to be protected and isolated, but researchers discovered that in some cases, the information can be exposed while the processor queues it up.
Researchers said almost every computing system — desktops, laptops, smartphones, and cloud servers — is affected by the Spectre bug. Meltdown appears to be specific to chips made by Intel.
Apple users should make sure their computers, iOS devices, and all apps they use are kept up to date to protect themselves against hackers exploiting the flaws.
“Since exploiting many of these issues requires a malicious app to be loaded on your Mac or iOS device, we recommend downloading software only from trusted sources such as the App Store,” the company said.
That is good advice regardless of whether or not your phone has a flaw in the processor.
Other major companies rolling out fixes include Microsoft, Amazon and Google.
Fixing the problems will slow a computer’s performance, experts say, especially on devices more than five years old.
Intel said that “for the average user,” the performance impact on products using the processors from the last five years “should not be significant and will be mitigated over time.”
The bigger challenge appears to be for companies that deal with a lot of network traffic and considerable processing power — things like cloud computing providers, retailers that process consumer transactions and medical systems that crunch data.
Some experts say that to completely get rid of the risks created by the flaws, the affected processors need to be replaced entirely. But that’s not realistically going to happen anytime soon.
There aren’t any processors available at the moment that can replace the vulnerable ones and still provide the same kind of functionality.
Experts say that it will take years to bring to market new chips that can perform the same tasks both safely and effectively.
