⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2018-3639

CWE-203CWE-226CWE-200 — Information Exposure33 documents12 sources
Severity
5.5MEDIUM
EPSS
46.0%
top 2.37%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
76
Nvidia Jetson TX1Nvidia Jetson TX2Schneider-electric Struxureware Data Center Expert+73 more
Timeline
PublishedMay 22
Latest updateJul 15

Description

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages76 packages

▶NVDnvidia/jetson_tx1< r28.3
▶NVDnvidia/jetson_tx2< r28.3

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 12.04, 14.04, 16.04, 17.10, 18.04, Enterprise Linux 6.7, 7.3, 7.4, 7.5, 7.6, 7.7, 5.9, 6.4, 6.5, 6.6, 7.2

Patches

Patch: bugs.chromium.org ↗Patch: portal.msrc.microsoft.com ↗Patch: bugs.chromium.org ↗

🔴Vulnerability Details

9
OSV
intel-microcode vulnerabilities↗2018-08-27
▶
OSV
libvirt vulnerability and update↗2018-06-12
▶
OSV
linux, linux-aws, linux-kvm, vulnerabilities↗2018-05-22
▶
OSV
CVE-2018-3639: Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes↗2018-05-22
▶
OSV
linux vulnerabilities↗2018-05-22
▶

💥Exploits & PoCs

1
Exploit-DB
AMD / ARM / Intel - Speculative Execution Variant 4 Speculative Store Bypass↗2018-05-22
▶

📋Vendor Advisories

18
Oracle
Oracle Oracle Communications Applications Risk Matrix: Kernel — CVE-2018-3639↗2020-07-15
▶
Apple
CVE-2018-3639: macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra↗2018-10-30
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2018-10-23
▶
Apple
CVE-2018-3639: macOS Mojave 10.14↗2018-09-24
▶
Ubuntu
Intel Microcode vulnerabilities↗2018-08-27
▶

💬Community

4
Bugzilla
CVE-2018-3639 libvirt: hw: cpu: speculative store bypass [fedora-all]↗2018-06-19
▶
Bugzilla
CVE-2018-3639 qemu: hw: cpu: speculative store bypass [fedora-all]↗2018-06-19
▶
Bugzilla
CVE-2018-3639 kernel: hw: cpu: speculative store bypass [fedora-all]↗2018-05-21
▶
Bugzilla
CVE-2018-3639 hw: cpu: speculative store bypass↗2018-04-13
▶