Please note a new version of the post was created on 13 April 2018.
Update January 25th 2018
Meltdown and Spectre are the names of two serious security flaws that has been found within computer processors. They could potentially allow hackers to steal sensitive data without users knowing.
The fixes needed to protect against Meltdown and Spectre might have the unfortunate side effect of having significant performance impact on Windows and Linux operating systems.
What is Meltdown?
Meltdown is a security flaw that could allow malicious software to illegally access memory that belongs to the kernel, or another software process. It works by circumventing the memory barriers between applications run in user space and kernel space by an attack involving speculative execution. A branch misprediction is provoked in one of several ways, causing the CPU to speculatively execute an illegal code sequence. This is caught by the CPU after the branch is executed, and subsequently rolled back. However, its effect on the hardware cache is not rolled back, and measuring the response time of various accesses to the cache can pinpoint what data was stored in the memory of the victim process through the address space of the adversary.
The software fix involves separating the memory page tables of the user space and kernel space, which inevitably leads to a negative performance impact on communication between user level applications and the kernel.
What is Spectre?
Spectre is a security flaw that affects modern microprocessors that perform branch prediction. It can be used to trick otherwise error-free applications into giving up secret information by taking advantage of a delay in the time it may take the CPU to check the validity of a memory access call.
The following table describes what needs to be done in Microsoft Windows environments to mitigate the Meltdown and Spectre security flaws.
Common Vulnerabilities and Exposures (CVE) ID
Public CVE name
Windows changes needed
Windows patches needed?
BIOS patches needed?
Bounds Check Bypass
Recompile with a new compiler
Branch Target Injection
New CPU instructions that eliminate branch speculation
SEE NOTE (2)
Rogue Data Cache Load
Isolate kernel and user mode page tables
Yes, see (1) below.
(1) The operating system patches have to be enabled in the Windows registry or they will not have any effect. See "Enabling protections on the server" here: https://support.microsoft.com/en-za/help/4072698/windows-server-guidance-to-protect-against-the-speculative-execution
How is Qlik software impacted?
Qlik products are built on top of underlying components such as Operating Systems (OS) and chipsets, therefore Qlik products will rely on the OS fixes for both Spectre and Meltdown to mitigate the security risks.
The Qlik Performance and Stability centre are in progress of testing both QlikView and Qlik Sense with operating systems and system BIOS patches that address the Meltdown & Spectre security flaws. Tests include measuring the load of concurrent users ranging from low to high scenarios. High load in this case is a continuously growing number of concurrent users (up to 300) triggering light calculations with minimum think time between the clicks. The users avoided selecting cached values. The complete bandwidth of the system was tested since the processor needed to calculate every result, which meant that a queue of clicks to serve was built up.
The following conclusions are based on the results of the ongoing tests with currently available patches. We are sharing our conclusions here in the spirt of openness and transparency and they may change as more results are gathered.
Qlik Sense on Windows
A degrade of 4-20% in the response time and reload duration during typical conditions. The low and medium load scenarios are least affected.
The high load scenarios, especially on four-socket machines, are impacted most with the Spectre patch. SEE NOTE (2)
Results are similar to those for Qlik Sense.
No degrade for Qlik Sense.
A degrade of around 10% for QlikView Server.
(2) NOTE Important note regarding the Spectre patch: (update 2018-01-22)
Intel has communicated new guidance regarding 'reboot issues and unpredictable system behavior' with the microcode included in the BIOS updates released to address Spectre (Variant 2), CVE-2017-5715.
In response Dell is advising that all customers should not deploy the BIOS update for the Spectre (Variant 2) vulnerability at this time and have removed the impacted BIOS updates from their support pages.
“If you have already deployed the BIOS update, in order to avoid unpredictable system behavior, you can revert back to a previous BIOS version.
As a reminder, the Operating System patches are not impacted and still provide mitigation to Spectre (Variant 1) and Meltdown (Variant 3). The microcode update is only required for Spectre (Variant 2), CVE-2017-5715."
More information is available on Dell Knowledge Base here
Qlik will be retesting when new patches are available and will update this support blog in due course
Product Versions tested:
- Qlik Sense November 2017
- QlikView 12.10 SR8
- Qlik NPrinting February 2018 Release Candidate
For more information, please see the following pages:
Relevant research papers for deep diving:
Information on vendor fixes:
- Apple information: https://support.apple.com/en-us/HT208394
- AWS information: https://aws.amazon.com/security/security-bulletins/AWS-2018-013/
- Dell information: http://www.dell.com/support/article/us/en/04/sln308588/microprocessor-side-channel-vulnerabilities-cve-2017-5715-cve-2017-5753-cve-2017-5754-impact-on-dell-emc-products-dell-enterprise-servers-storage-and-networking-?lang=en
- Google information: https://googleprojectzero.blogspot.co.uk/2018/01/reading-privileged-memory-with-side.html
- Intel information:
- Microsoft information:
Thank you for choosing Qlik!
Global Support Team