Medium severity · published May 22, 2018
CVE-2018-3639
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow…
5.5
CVSS
60.6%
EPSS
No
On KEV
Description
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)60.6% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Atom C · Intel
c2308; c3308; c3338; c3508; c3538; c3558; +10 more · source: NVD
AE
Atom E · Intel
e3805; e3815; e3825; e3826; e3827; e3845 · source: NVD
AX
Atom X5-e3930 · Intel
All versions, or not specified · source: NVD
AX
Atom X5-e3940 · Intel
All versions, or not specified · source: NVD
AX
Atom X7-e3950 · Intel
All versions, or not specified · source: NVD
AZ
Atom Z · Intel
z2420; z2460; z2480; z2520; z2560; z2580; +24 more · source: NVD
CJ
Celeron J · Intel
j3455; j4005; j4105 · source: NVD
CN
Celeron N · Intel
n3450 · source: NVD
CI
Core I3 · Intel
32nm; 45nm · source: NVD
CI
Core I5 · Intel
32nm; 45nm · source: NVD
CI
Core I7 · Intel
32nm; 45nm · source: NVD
CM
Core M · Intel
32nm; 45nm · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-3639
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-3639
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html
Third Party Advisory
http://support.lenovo.com/us/en/solutions/LEN-22133
Third Party Advisory
http://www.fujitsu.com/global/support/products/software/security/products-f/cve-2018-3639e.html
Mailing List
http://www.openwall.com/lists/oss-security/2020/06/10/1
More from Atom C
7.6
CVE-2018-3652
Existing UEFI setting restrictions for DCI (Direct Connect Interface) in 5th and 6th generation Intel Xeon Processor E3 Family, Intel Xeon Scalable processors, and Intel Xeon…
5.6
CVE-2018-3693
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a…
5.6
CVE-2018-3640
Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an…
5.6
CVE-2018-9056
Systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to an attacker with local user access via a side-channel attack on…
5.6
CVE-2017-5754
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access…