Please note a new version of the post was created on 13 April 2018.


Update January 25th 2018

Introduction:

Meltdown and Spectre are the names of two serious security flaws that has been found within computer processors. They could potentially allow hackers to steal sensitive data without users knowing.

The fixes needed to protect against Meltdown and Spectre might have the unfortunate side effect of having significant performance impact on Windows and Linux operating systems.

 

What is Meltdown?

Meltdown is a security flaw that could allow malicious software to illegally access memory that belongs to the kernel, or another software process. It works by circumventing the memory barriers between applications run in user space and kernel space by an attack involving speculative execution. A branch misprediction is provoked in one of several ways, causing the CPU to speculatively execute an illegal code sequence. This is caught by the CPU after the branch is executed, and subsequently rolled back. However, its effect on the hardware cache is not rolled back, and measuring the response time of various accesses to the cache can pinpoint what data was stored in the memory of the victim process through the address space of the adversary.

The software fix involves separating the memory page tables of the user space and kernel space, which inevitably leads to a negative performance impact on communication between user level applications and the kernel.

 

What is Spectre?

Spectre is a security flaw that affects modern microprocessors that perform branch prediction. It can be used to trick otherwise error-free applications into giving up secret information by taking advantage of a delay in the time it may take the CPU to check the validity of a memory access call.

Mitigation

The following table describes what needs to be done in Microsoft Windows environments to mitigate the Meltdown and Spectre security flaws.

Security flaw

Common Vulnerabilities and Exposures (CVE) ID

Exploit name

Public CVE name

Windows changes needed

Windows patches needed?

BIOS patches needed?

Spectre

CVE-2017-5753

Variant 1

Bounds Check Bypass

Recompile with a new compiler

Hardened browser to prevent exploit from JavaScript

No

No

Spectre

CVE-2017-5715

Variant 2

Branch Target Injection

New CPU instructions that eliminate branch speculation

No

Yes

SEE NOTE (2)

Meltdown

CVE-2017-5754

Variant 3

Rogue Data Cache Load

Isolate kernel and user mode page tables

Yes, see (1) below.

Patches:

No

(1) The operating system patches have to be enabled in the Windows registry or they will not have any effect. See "Enabling protections on the server" here: https://support.microsoft.com/en-za/help/4072698/windows-server-guidance-to-protect-against-the-speculative-execution

 

How is Qlik software impacted?

Qlik products are built on top of underlying components such as Operating Systems (OS) and chipsets, therefore Qlik products will rely on the OS fixes for both Spectre and Meltdown to mitigate the security risks.

 

The Qlik Performance and Stability centre are in progress of testing both QlikView and Qlik Sense with operating systems and system BIOS patches that address the Meltdown & Spectre security flaws. Tests include measuring the load of concurrent users ranging from low to high scenarios. High load in this case is a continuously growing number of concurrent users (up to 300) triggering light calculations with minimum think time between the clicks. The users avoided selecting cached values. The complete bandwidth of the system was tested since the processor needed to calculate every result, which meant that a queue of clicks to serve was built up.

The following conclusions are based on the results of the ongoing tests with currently available patches. We are sharing our conclusions here in the spirt of openness and transparency and they may change as more results are gathered.

Configuration

Conclusion

Qlik Sense on Windows

A degrade of 4-20% in the response time and reload duration during typical conditions. The low and medium load scenarios are least affected.

The high load scenarios, especially on four-socket machines, are impacted most with the Spectre patch. SEE NOTE (2)

QlikView Server

Results are similar to those for Qlik Sense.

NPrinting

No degrade for Qlik Sense.

A degrade of around 10% for QlikView Server.

(2) NOTE Important note regarding the Spectre patch: (update 2018-01-22)

Intel has communicated new guidance regarding 'reboot issues and unpredictable system behavior' with the microcode included in the BIOS updates released to address Spectre (Variant 2), CVE-2017-5715.

https://newsroom.intel.com/news/root-cause-of-reboot-issue-identified-updated-guidance-for-customers-and-partners/

In response Dell is advising that all customers should not deploy the BIOS update for the Spectre (Variant 2) vulnerability at this time and have removed the impacted BIOS updates from their support pages.

“If you have already deployed the BIOS update, in order to avoid unpredictable system behavior, you can revert back to a previous BIOS version.

As a reminder, the Operating System patches are not impacted and still provide mitigation to Spectre (Variant 1) and Meltdown (Variant 3). The microcode update is only required for Spectre (Variant 2), CVE-2017-5715."

More information is available on Dell Knowledge Base here

Qlik will be retesting when new patches are available and will update this support blog in due course

Product Versions tested:

  • Qlik Sense November 2017
  • QlikView 12.10 SR8
  • Qlik NPrinting February 2018 Release Candidate

 

Links:

For more information, please see the following pages:

Relevant research papers for deep diving:

 

Information on vendor fixes:

Thank you for choosing Qlik!

 

Kind regards

Global Support Team