Last week, security researchers published two vulnerabilities—known as Meltdown and Spectre—which affect the majority of modern computers. Both of these vulnerabilities target low-level functionality of CPU chips, making it possible to read process- and kernel-level data.

The technical explanation of these vulnerabilities can seem complex because it requires knowledge of CPU architecture. In simple terms, these attacks break a key security measure known as “isolation”, which is meant to limit the data that can be accessed by a computer process. If you think of each process running on your computer as a room in a hotel, these vulnerabilities give you access to every room—not just your own.

These vulnerabilities allow an attacker to “dump” (save the data currently running) the memory of a computer. This can give them access to incredibly sensitive information. Passwords, cryptographic keys, and files can all be found within computer memory if they were open or being used by applications.

These vulnerabilities do not directly affect the SSL/TLS protocol or SSL/TLS certificates; instead, they affect the CPU chips themselves. In some scenarios, the ability for attackers to read the memory of a computer could pose a risk to the security of SSL connections and private keys.

On shared cloud-based servers, where multiple virtual machines are sharing physical memory on one physical machine, there is a risk that one of those shared users could view and record the data of the others. This could allow attackers to compromise private keys stored on these shared cloud servers and other data being transmitted through them.

Cloud providers have already begun implementing patches and mitigations to reduce this risk. For example, major platforms including Amazon’s EC2 and Microsoft Azure have put protections in place. US-CERT has a security advisory with an extensive list of vendor information that can provide information about patches and mitigations available for your specific platform.

As a trusted CA, DigiCert handles sensitive security procedures, such as certificate signing, on private machines which are not accessible by the internet, as one of several techniques to mitigate potential risks like those found in Meltdown and Spectre.

We aren’t aware of any active exploits of Meltdown or Spectre. Due to the difficulty in exploiting these vulnerabilities, we aren’t currently advising customers to rekey or reissue their DigiCert SSL/TLS certificates. Instead, we recommend that customers prioritize patching their systems and checking with their vendor’s advisory.