According to the National Vulnerability Database (https://nvd.nist.gov), both Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5753 & CVE-2017-5715) require local user access to exploit the vulnerability. Keep in mind that your greatest level of protection from these, and most other, vulnerabilities can be achieved by following strong security practices: including vetting & limiting user access, limiting physical access, auditing data center security, using only trusted web sites and software sources, not using a web browser directly on your servers (if possible), and assuring that your anti-virus / malware protection is configured to receive regular updates.
Both vulnerabilities exploit features in the Speculative Execution Optimizations on modern processors. RedHat and Windows have released initial security patches to address these vulnerabilities, but because the vulnerabilities are within optimization routines, the patches MAY incur reduced performance under certain workloads. There is currently mixed information on the performance issues, with reports ranging from no measurable impact to performance degradation of up to 30%. We are working hard to understand the potential impact to your environment, and we will keep you posted as the situation develops.
If you do choose to patch your systems at this time, there are a few things you should be aware of:
The main public threats at the moment are privacy and confidentiality concerns in Multitenant Infrastructure as a Service (IaaS) environments where an attacker could potentially attempt to exploit the vulnerability by merely using the service (after likely breaking the Acceptable Use Policy and likely the Law as well). Most dedicated environments are just patching as usual.
Hardware vendors are rushing to implement firmware updates where possible. If you do not have an immediate need to update your firmware, it may be advisable to wait until the firmware updates have been available for a few weeks to assure there are no unforeseen issues with the updates. This is a risk/reward decision that will vary with your individual needs.
For more information check out this resource page (https://spectreattack.com/). This resource was created by the researchers who discovered and responsibly disclosed the bugs. As always, the Solutions II team is here to help with this or any IT concerns you may have. You can reach out to us at info@solutions-ii.com or if you would rather leave the worrying up to the experts, here's some information about Managed IT Services.