CVE-2018-3639 Information disclosure in Multiple

What is CVE-2018-3639?

CVE-2018-3639 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 22 May 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.

Weakness: CWE-203

Which versions are affected by CVE-2018-3639?

It affects 282 products.

Products include Arm Cortex-A, Canonical Ubuntu Linux, Debian Debian Linux, Intel Atom C, Intel Atom E, Intel Atom X5-E3930 and 276 more.

How do I fix CVE-2018-3639?

Apply the vendor's patch.

Is CVE-2018-3639 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-3639 exists.

Public exploit code: 1 Exploit-DB entry and 4 proofs of concept on GitHub.

Other vulnerabilities in Canonical Ubuntu Linux

• CVE-2018-3693 Information disclosure in Most Modern Operating Systems Medium 5.6
• CVE-2018-3640 Information disclosure in Multiple Medium 5.6
• CVE-2018-9056 Information disclosure in n/a Medium 5.6
• CVE-2017-5715 Information disclosure in Microprocessors with Speculative Execution Medium 5.6
• CVE-2017-5754 Information disclosure in Most Modern Operating Systems Medium 5.6

All Canonical Ubuntu Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as ALPINE-CVE-2018-3639, CLEANSTART-2026-JY98800, DEBIAN-CVE-2018-3639, DSA-4210-1, MGASA-2018-0262, MGASA-2018-0298 and 91 more.