Vulnerability in Arm Cortex-A
CVE-2018-3639
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.606 (99.1th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.606 · newest: 0.606 · change: 0.000
Affected products
- Arm Cortex-A — versions 15, 57, 72
- Intel Atom C — versions c2308, c3308, c3338
- Intel Atom E — versions e3805, e3815, e3825
- Intel Atom X5-E3930
- Intel Atom X5-E3940
- Intel Atom X7-E3950
- Intel Atom Z — versions z2420, z2460, z2480
- Intel Celeron J — versions j3455, j4005, j4105
- Intel Celeron N — versions n3450
- Intel Core I3 — versions 32nm, 45nm
Weakness classification (CWE)
Public proof-of-concept exploits
- mmxsrup/CVE-2018-3639
- tyhicks/ssbd-tools
- Shuiliusheng/CVE-2018-3639-specter-v4-
- malindarathnayake/Intel-CVE-2018-3639-Mitigation_RegistryUpdate
- CKExploits/pwnlinux
- CyberHansel/WIN-Hardening
- NoelBradford/Windows11-Hardening-Powershell-Scripts
- PooyaAlamirpour/willyb321-stars
- alyaparan/Spectre-Meltdown
- ambynotcoder/C-libraries
References
- access.redhat.com/errata/RHSA-2018:1689 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:2162 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:1641 (vendor-advisory, Third Party Advisory)
- usn.ubuntu.com/3680-1/ (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:1997 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:1665 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:3407 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:2164 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:2001 (vendor-advisory, Third Party Advisory)
- access.redhat.com/errata/RHSA-2018:3423 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-3639?
- CVE-2018-3639 is a medium-severity vulnerability in Arm Cortex-A, classified under Observable Discrepancy. CVSS score: 5.5/10. Published 2018-05-22.
- How severe is CVE-2018-3639?
- Medium severity. CVSS v3 base score is 5.5 out of 10.
- Is CVE-2018-3639 known to be exploited?
- 70 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.