Medium severity · published May 22, 2018
CVE-2018-3640
Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an…
5.6
CVSS
7.3%
EPSS
No
On KEV
Description
Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis, aka Rogue System Register Read (RSRE), Variant 3a.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)7.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Atom C · Intel
c2308; c3308; c3338; c3508; c3538; c3558; +10 more · source: NVD
AE
Atom E · Intel
e3805; e3815; e3825; e3826; e3827; e3845 · source: NVD
AZ
Atom Z · Intel
z2420; z2460; z2480; z2520; z2560; z2580; +24 more · source: NVD
CJ
Celeron J · Intel
j3455; j4005; j4105 · source: NVD
CN
Celeron N · Intel
n3450 · source: NVD
CI
Core I3 · Intel
32nm; 45nm · source: NVD
CI
Core I5 · Intel
32nm; 45nm · source: NVD
CI
Core I7 · Intel
32nm; 45nm · source: NVD
CM
Core M · Intel
32nm; 45nm · source: NVD
PE
Pentium · Intel
n4000; n4100; n4200 · source: NVD
PJ
Pentium J · Intel
j4205 · source: NVD
PS
Pentium Silver · Intel
j5005; n5000 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-3640
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-3640
Third Party Advisory
http://support.lenovo.com/us/en/solutions/LEN-22133
Third Party Advisory
http://www.fujitsu.com/global/support/products/software/security/products-f/cve-2018-3639e.html
Third Party Advisory
http://www.securityfocus.com/bid/104228
Third Party Advisory
http://www.securitytracker.com/id/1040949
www.securitytracker.com
http://www.securitytracker.com/id/1042004
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/pdf/ssa-268644.pdf
More from Atom C
7.6
CVE-2018-3652
Existing UEFI setting restrictions for DCI (Direct Connect Interface) in 5th and 6th generation Intel Xeon Processor E3 Family, Intel Xeon Scalable processors, and Intel Xeon…
5.6
CVE-2018-3693
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a…
5.6
CVE-2018-9056
Systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to an attacker with local user access via a side-channel attack on…
5.6
CVE-2017-5754
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access…
5.6
CVE-2017-5753
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a…