vulnwire
5.6med

CVE-2018-3640

Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.6
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
7.1%
percentile 94%
Public exploits
0
none known

Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis, aka Rogue System Register Read (RSRE), Variant 3a.

Exploit prediction (EPSS)

7.14% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.6CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD2.04.7AV:L/AC:M/Au:N/C:C/I:N/A:N

Affected products

  • Intel Corporation Multiple

Classification

Weakness

References

  • cert-portal.siemens.com /productcert/pdf/ssa-268644.pdf · x_refsource_CONFIRM, x_transferred
  • support.lenovo.com /us/en/solutions/LEN-22133 · x_refsource_CONFIRM, x_transferred
  • us-cert.gov /ncas/alerts/TA18-141A · third-party-advisory, x_refsource_CERT, x_transferred
  • securitytracker.com /id/1042004 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securitytracker.com /id/1040949 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • psirt.global.sonicwall.com /vuln-detail/SNWLID-2018-0005 · x_refsource_CONFIRM, x_transferred
  • intel.com /content/www/us/en/security-center/advisory/intel-sa-00115.html · x_refsource_CONFIRM, x_transferred
  • synology.com /support/security/Synology_SA_18_23 · x_refsource_CONFIRM, x_transferred
  • developer.arm.com /support/arm-security-updates/speculative-processor-vulnerability · x_refsource_CONFIRM, x_transferred
  • kb.cert.org /vuls/id/180049 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • fujitsu.com /global/support/products/software/security/products-f/cve-2018-3639e.html · x_refsource_CONFIRM, x_transferred
  • portal.msrc.microsoft.com /en-us/security-guidance/advisory/ADV180013 · x_refsource_CONFIRM, x_transferred
  • tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180521-cpusidechannel · vendor-advisory, x_refsource_CISCO, x_transferred
  • mitel.com /en-ca/support/security-advisories/mitel-product-security-advisory-18-0006 · x_refsource_CONFIRM, x_transferred
  • lists.debian.org /debian-lts-announce/2018/09/msg00017.html · mailing-list, x_refsource_MLIST, x_transferred
  • debian.org /security/2018/dsa-4273 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03850en_us · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/104228 · vdb-entry, x_refsource_BID, x_transferred
  • lists.debian.org /debian-lts-announce/2018/07/msg00038.html · mailing-list, x_refsource_MLIST, x_transferred
  • usn.ubuntu.com /3756-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • security.netapp.com /advisory/ntap-20180521-0001/ · x_refsource_CONFIRM, x_transferred
  • cert-portal.siemens.com /productcert/pdf/ssa-608355.pdf · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.