What’s Vulnerable › Vulnerabilities

CVE-2018-3640

• Severity: medium (CVSS 5.6 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-05-22 · updated 2026-06-17
• Weakness: CWE-203

Description

Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis, aka Rogue System Register Read (RSRE), Variant 3a.

Affected products

• Arm Cortex-A: 15, 57, 72
• Intel Atom C: c2308, c3308, c3338, c3508, c3538, c3558 (+10)
• Intel Atom E: e3805, e3815, e3825, e3826, e3827, e3845
• Intel Atom Z: z2420, z2460, z2480, z2520, z2560, z2580 (+24)
• Intel Celeron J: j3455, j4005, j4105
• Intel Celeron N: n3450
• Intel Core I3: 32nm, 45nm
• Intel Core I5: 32nm, 45nm
• Intel Core I7: 32nm, 45nm
• Intel Core M: 32nm, 45nm
• Intel Pentium: n4000, n4100, n4200
• Intel Pentium J: j4205
• Intel Pentium Silver: j5005, n5000
• Intel Xeon E-1105C: all versions
• Intel Xeon E3: 125c_, 1220_, 1275_, 1505m_v6, 1515m_v5, 1535m_v5 (+41)
• Intel Xeon E3 1105C V2: all versions
• Intel Xeon E3 1125C V2: all versions
• Intel Xeon E3 12201: all versions
• Intel Xeon E3 12201 V2: all versions
• Intel Xeon E3 1220 V2: all versions
• Intel Xeon E3 1220 V3: all versions
• Intel Xeon E3 1220 V5: all versions
• Intel Xeon E3 1220 V6: all versions
• Intel Xeon E3 1220L V3: all versions
• Intel Xeon E3 1225: all versions
• Intel Xeon E3 1225 V2: all versions
• Intel Xeon E3 1225 V3: all versions
• Intel Xeon E3 1225 V5: all versions
• Intel Xeon E3 1225 V6: all versions
• Intel Xeon E3 1226 V3: all versions

References

• http://support.lenovo.com/us/en/solutions/LEN-22133
• http://www.fujitsu.com/global/support/products/software/security/products-f/cve-2018-3639e.html
• http://www.securityfocus.com/bid/104228
• http://www.securitytracker.com/id/1040949
• http://www.securitytracker.com/id/1042004
• https://cert-portal.siemens.com/productcert/pdf/ssa-268644.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf
• https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability
• https://lists.debian.org/debian-lts-announce/2018/07/msg00038.html
• https://lists.debian.org/debian-lts-announce/2018/09/msg00017.html
• https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV180013
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0005

Get alerted when CVE-2018-3640 or the next vulnerability affects your stack