Vulnerability CVE-2018-3639

Vulnerability CVE-2018-3639

Published: 2018-05-22

Description:

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.

Type:

CWE-200

(Information Exposure)

CVSS2 => (AV:L/AC:L/Au:N/C:C/I:N/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
4.9/10	6.9/10	3.9/10

Exploit range	Attack complexity	Authentication
Local	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Complete	None	None

Affected software
Sonicwall -> Secure mobile access
Sonicwall -> Sonicosv
Sonicwall -> Web application firewall
Sonicwall -> Cloud global management system
Sonicwall -> Email security
Sonicwall -> Global management system
Siemens -> Sinema remote connect firmware
Siemens -> Sinumerik 840 d sl firmware
Siemens -> Sinumerik tcu 30.3 firmware
Siemens -> Ruggedcom ape firmware
Siemens -> Simatic ipc427c firmware
Siemens -> Simatic ipc477c firmware
Redhat -> Enterprise linux desktop
Redhat -> Enterprise linux server
Redhat -> Enterprise linux server aus
Redhat -> Enterprise linux server eus
Redhat -> Enterprise linux server tus
Redhat -> Enterprise linux workstation
Redhat -> Openstack
Redhat -> Virtualization
Oracle -> Solaris
Mitel -> Micloud management portal
Mitel -> Micollab
Mitel -> Mivoic mx-one
Mitel -> Mivoice 5000
Mitel -> Mivoice border gateway
Mitel -> Mivoice business
Mitel -> Mivoice connect
Mitel -> Open integration gateway
Intel -> Xeon e7
Intel -> Xeon gold
Intel -> Atom c
Intel -> Xeon platinum
Intel -> Atom e
Intel -> Xeon silver
Intel -> Atom z
Intel -> Celeron j
Intel -> Celeron n
Intel -> Core i3
Intel -> Core i5
Intel -> Core i7
Intel -> Core m
Intel -> Pentium
Intel -> Pentium j
Intel -> Pentium silver
Intel -> Xeon e3
Intel -> Xeon e5
Debian -> Debian linux
Canonical -> Ubuntu linux
ARM -> Cortex-a

References:

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html

http://support.lenovo.com/us/en/solutions/LEN-22133

http://www.fujitsu.com/global/support/products/software/security/products-f/cve-2018-3639e.html

http://www.securityfocus.com/bid/104232

http://www.securitytracker.com/id/1040949

http://www.securitytracker.com/id/1042004

http://xenbits.xen.org/xsa/advisory-263.html

https://access.redhat.com/errata/RHSA-2018:1629

https://access.redhat.com/errata/RHSA-2018:1630

https://access.redhat.com/errata/RHSA-2018:1632

https://access.redhat.com/errata/RHSA-2018:1633

https://access.redhat.com/errata/RHSA-2018:1635

https://access.redhat.com/errata/RHSA-2018:1636

https://access.redhat.com/errata/RHSA-2018:1637

https://access.redhat.com/errata/RHSA-2018:1638

https://access.redhat.com/errata/RHSA-2018:1639

https://access.redhat.com/errata/RHSA-2018:1640

https://access.redhat.com/errata/RHSA-2018:1641

https://access.redhat.com/errata/RHSA-2018:1642

https://access.redhat.com/errata/RHSA-2018:1643

https://access.redhat.com/errata/RHSA-2018:1644

https://access.redhat.com/errata/RHSA-2018:1645

https://access.redhat.com/errata/RHSA-2018:1646

https://access.redhat.com/errata/RHSA-2018:1647

https://access.redhat.com/errata/RHSA-2018:1648

https://access.redhat.com/errata/RHSA-2018:1649

https://access.redhat.com/errata/RHSA-2018:1650

https://access.redhat.com/errata/RHSA-2018:1651

https://access.redhat.com/errata/RHSA-2018:1652

https://access.redhat.com/errata/RHSA-2018:1653

https://access.redhat.com/errata/RHSA-2018:1654

https://access.redhat.com/errata/RHSA-2018:1655

https://access.redhat.com/errata/RHSA-2018:1656

https://access.redhat.com/errata/RHSA-2018:1657

https://access.redhat.com/errata/RHSA-2018:1658

https://access.redhat.com/errata/RHSA-2018:1659

https://access.redhat.com/errata/RHSA-2018:1660

https://access.redhat.com/errata/RHSA-2018:1661

https://access.redhat.com/errata/RHSA-2018:1662

https://access.redhat.com/errata/RHSA-2018:1663

https://access.redhat.com/errata/RHSA-2018:1664

https://access.redhat.com/errata/RHSA-2018:1665

https://access.redhat.com/errata/RHSA-2018:1666

https://access.redhat.com/errata/RHSA-2018:1667

https://access.redhat.com/errata/RHSA-2018:1668

https://access.redhat.com/errata/RHSA-2018:1669

https://access.redhat.com/errata/RHSA-2018:1674

https://access.redhat.com/errata/RHSA-2018:1675

https://access.redhat.com/errata/RHSA-2018:1676

https://access.redhat.com/errata/RHSA-2018:1686

https://access.redhat.com/errata/RHSA-2018:1688

https://access.redhat.com/errata/RHSA-2018:1689

https://access.redhat.com/errata/RHSA-2018:1690

https://access.redhat.com/errata/RHSA-2018:1696

https://access.redhat.com/errata/RHSA-2018:1710

https://access.redhat.com/errata/RHSA-2018:1711

https://access.redhat.com/errata/RHSA-2018:1737

https://access.redhat.com/errata/RHSA-2018:1738

https://access.redhat.com/errata/RHSA-2018:1826

https://access.redhat.com/errata/RHSA-2018:1854

https://access.redhat.com/errata/RHSA-2018:1965

https://access.redhat.com/errata/RHSA-2018:1967

https://access.redhat.com/errata/RHSA-2018:1997

https://access.redhat.com/errata/RHSA-2018:2001

https://access.redhat.com/errata/RHSA-2018:2003

https://access.redhat.com/errata/RHSA-2018:2006

https://access.redhat.com/errata/RHSA-2018:2060

https://access.redhat.com/errata/RHSA-2018:2161

https://access.redhat.com/errata/RHSA-2018:2162

https://access.redhat.com/errata/RHSA-2018:2164

https://access.redhat.com/errata/RHSA-2018:2171

https://access.redhat.com/errata/RHSA-2018:2172

https://access.redhat.com/errata/RHSA-2018:2216

https://access.redhat.com/errata/RHSA-2018:2228

https://access.redhat.com/errata/RHSA-2018:2246

https://access.redhat.com/errata/RHSA-2018:2250

https://access.redhat.com/errata/RHSA-2018:2258

https://access.redhat.com/errata/RHSA-2018:2289

https://access.redhat.com/errata/RHSA-2018:2309

https://access.redhat.com/errata/RHSA-2018:2328

https://access.redhat.com/errata/RHSA-2018:2363

https://access.redhat.com/errata/RHSA-2018:2364

https://access.redhat.com/errata/RHSA-2018:2387

https://access.redhat.com/errata/RHSA-2018:2394

https://access.redhat.com/errata/RHSA-2018:2396

https://access.redhat.com/errata/RHSA-2018:2948

https://access.redhat.com/errata/RHSA-2018:3396

https://access.redhat.com/errata/RHSA-2018:3397

https://access.redhat.com/errata/RHSA-2018:3398

https://access.redhat.com/errata/RHSA-2018:3399

https://access.redhat.com/errata/RHSA-2018:3400

https://access.redhat.com/errata/RHSA-2018:3401

https://access.redhat.com/errata/RHSA-2018:3402

https://access.redhat.com/errata/RHSA-2018:3407

https://access.redhat.com/errata/RHSA-2018:3423

https://access.redhat.com/errata/RHSA-2018:3424

https://access.redhat.com/errata/RHSA-2018:3425

https://access.redhat.com/errata/RHSA-2019:0148

https://access.redhat.com/errata/RHSA-2019:1046

https://bugs.chromium.org/p/project-zero/issues/detail?id=1528

https://cert-portal.siemens.com/productcert/pdf/ssa-268644.pdf

https://cert-portal.siemens.com/productcert/pdf/ssa-505225.pdf

https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability

https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0

https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html

https://lists.debian.org/debian-lts-announce/2018/07/msg00038.html

https://lists.debian.org/debian-lts-announce/2018/09/msg00017.html

https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html

https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html

https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html

https://nvidia.custhelp.com/app/answers/detail/a_id/4787

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180012

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0004

https://security.netapp.com/advisory/ntap-20180521-0001/

https://support.citrix.com/article/CTX235225

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03850en_us

https://support.oracle.com/knowledge/Sun%20Microsystems/2481872_1.html

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180521-cpusidechannel

https://usn.ubuntu.com/3651-1/

https://usn.ubuntu.com/3652-1/

https://usn.ubuntu.com/3653-1/

https://usn.ubuntu.com/3653-2/

https://usn.ubuntu.com/3654-1/

https://usn.ubuntu.com/3654-2/

https://usn.ubuntu.com/3655-1/

https://usn.ubuntu.com/3655-2/

https://usn.ubuntu.com/3679-1/

https://usn.ubuntu.com/3680-1/

https://usn.ubuntu.com/3756-1/

https://usn.ubuntu.com/3777-3/

https://www.debian.org/security/2018/dsa-4210

https://www.debian.org/security/2018/dsa-4273

https://www.exploit-db.com/exploits/44695/

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00115.html

https://www.kb.cert.org/vuls/id/180049

https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0006

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

https://www.synology.com/support/security/Synology_SA_18_23

https://www.us-cert.gov/ncas/alerts/TA18-141A

Vulnerability CVE-2018-3639

CWE-200

CVSS2 => (AV:L/AC:L/Au:N/C:C/I:N/A:N)

4.9/10

6.9/10

3.9/10

Local

Low

No required

Complete

None

None

Affected software

References: