The current consoles are using AMD/ARM processors, probably they aren't affected that much.

It could be still a problem though, considering many console games use all kinds of hacks to barely run at the target resolution/framerate.

> It could be still a problem though, considering many console games use all kinds of hacks to barely run at the target resolution/framerate.

If you had to slow down any of the consoles by 10% there would be tons of problems in the games. As you said, those games are highly tweaked to just barely run on those CPUs/GPUs.

I'm not sure about the PS4 and XBone but the Switch uses the Tegra X1, which has 8 ARM cores (4 Cortex-A53 cores, 4 Cortex-A57 cores), 4 of which (the Cortex-A57 cores) are vulnerable.

https://en.wikipedia.org/wiki/Tegra#Tegra_X1

https://developer.arm.com/support/security-update

Vulnerable to Spectre, yes, like nearly all speculative execution processors. The PS4, XBone and Switch are very likely vulnerable to Spectre all the same but that will probably mostly affect their web browsers.

None of these is vulnerable to Meltdown. That is an Intel/Apple/ARM Cortex A75 only thing.

It affects WAY more ARM processors than A75. All the fast ARM cores are vulnerable to one of the two meltdown flaws and half are vulnerable to a subset of the third flaw (with A75 being completely vulnerable).

https://developer.arm.com/support/security-update

> All the fast ARM cores are vulnerable to one of the two meltdown flaws

Do you mean Spectre? Meltdown is the Variant 3 in that link.

> It affects WAY more ARM processors than A75. All the fast ARM cores ...

The ARM cores listed on that page are not all the ARM cores in the market (or running in the real-world). There are many more ARM cores than listen in that table, and the page says any ARM core not listed in that table is not vulnerable to any variant of Meltdown or Spectre.

Console manufacturers don't run unsigned code, so I expect they'll just sit still until the next hardware refresh.

I wouldn't be so sure of that. They at least run Javascript through their web browser.

The Nintendo Switch generally only allows white-listed pages. So the attack vector is pretty small. The other consoles, yes, should be possible. But I think not too many people use their consoles for browsing.

It will show any captive WiFi-portal however so perhaps watch out for that.

In addition they do have a store with indie games which seems to be more or less open to anyone (I assume there are some checks but I wouldn't trust them completely) much like Steam.

The requirements for getting onto the various platforms are pretty stringent. It's nowhere near as easy as getting onto Steam. You have to go through quite a rigorous certification process before you are allowed to ship your game on the online stores.

The Switch only allows whitelisted pages, but sometimes loads them over HTTP (notably Puyo Puyo Tetris opens a web applet to http://sega.jp), so you can MITM yourself and load arbitrary content including your own JS.

Only the hacker needs to do it for there to be a problem

I wonder if you can use Spectre to steal signing keys from the device and jailbreak them. I guess they probably only have the public keys though, for verification.

Modern consoles now come with web browsers, and the researchers proved that the attacks could be performed via web browsers, did they not?

Next patch: we enhanced your security by disabling execution of JavaScript from untrusted domains. In unrelated news, we now block ads!

If they are going to block JavaScript, they need to do it for all domains, not just untrusted domains. For example, if I can MITM my own website activity (which I can, by having a device that sits between a router and a console), then I can change the JavaScript coming from trusted domains.

In other words, if I visit a site like Google or Facebook on an affected device, I can change the JavaScript that is run, and make it still appear like it came from a trusted domain.

You can't just mitm when the JavaScript is served over https, unless you also can install your own certificates on the machine you're trying to hack. But when you have permissions to install new certificates you probably don't need the hack in the first place.

You can be prevented from a successful MITM by enforcing HTTPS using HSTS and pinning the keys of trusted sites. That's not a viable solution for accessing the internet at large, but for a console that is only incidentally used for web browsing, it's absolutely an option.

There are dozens of ways to prevent this, viable because you fully control the hardware and software stack of the terminal (and only allow contacting servers of your choosing).

I imagine they are more concerned about game authors snooping keys or whatnot.

Not unsigned code, but Xbox One runs apps from the Store. There should be a fair amount of checks before an app lands on the store, but you can never be sure.

What console of the current generation comes with an Intel CPU?

And in any case the Meltdown patch is not too bad for games.

PS4 and XBox One are running AMD CPUs (albiet x86-64 arch) this generation and the Switch is NVIDIA (ARM Aarch64).

> "What console of the current generation comes with an Intel CPU?"

The Switch appears to be based on ARM cores that are vulnerable.

Will this aid homebrew communities in their efforts to run unsigned code on the PS4, xbone, Switch et al?

I suspect not, but I could see it used to discover future vulnerabilities. Read access to all of memory is pretty powerful.