• by Ray Schultz , January 12, 2018

When Google out to protect users from the Spectre and Meldown vulnerabilities, it faced a tough challenge. The problems weren’t “just hard to find, they were even harder to fix,” the company said yesterday in a blog post.

Variants 1 (Spectre) and 3 (Meltdown) were relatively easy to handle 

“In September, we began deploying solutions for both Variants 1 and 3 to the production infrastructure that underpins all Google products — from Cloud services to Gmail, Search and Drive — and more-refined solutions in October,” Google writes.

It was able to do this “without any performance degradation” or slowdown in services like Gmail, it adds. 

But Variant 2 (Spectre) was a different story. Google notes that “it was clear from the outset that Variant 2 was going to be much harder to mitigate.”

For several months, it seemed that Google would have to disable “the vulnerable CPU features,” slowing down applications.

But then it hit a breakthrough: “Retpoline” — a novel software binary modification technique that prevents branch-target-injection, created by Paul Turner, a software engineer who is part of our Technical Infrastructure group.”

It adds, “With Retpoline, we didn't need to disable speculative execution or other hardware features. Instead, this solution modifies programs to ensure that execution cannot be influenced by an attacker.” 

That solution caused “no perceptible impact in our cloud and required no customer downtime,” Google states.

Still, Google concedes that “this set of vulnerabilities was perhaps the most challenging and hardest to fix in a decade, requiring changes to many layers of the software stack. It also required broad industry collaboration since the scope of the vulnerabilities was so widespread.”